| /* |
| * lib/netfilter/exp_obj.c Conntrack Expectation Object |
| * |
| * This library is free software; you can redistribute it and/or |
| * modify it under the terms of the GNU Lesser General Public |
| * License as published by the Free Software Foundation version 2.1 |
| * of the License. |
| * |
| * Copyright (c) 2003-2008 Thomas Graf <tgraf@suug.ch> |
| * Copyright (c) 2007 Philip Craig <philipc@snapgear.com> |
| * Copyright (c) 2007 Secure Computing Corporation |
| * Copyright (c) 2012 Rich Fought <rich.fought@watchguard.com> |
| */ |
| |
| #include <sys/types.h> |
| #include <netinet/in.h> |
| #include <linux/netfilter/nfnetlink_conntrack.h> |
| #include <linux/netfilter/nf_conntrack_common.h> |
| #include <linux/netfilter/nf_conntrack_tcp.h> |
| |
| #include <netlink-private/netlink.h> |
| #include <netlink/netfilter/nfnl.h> |
| #include <netlink/netfilter/exp.h> |
| |
| // The 32-bit attribute mask in the common object header isn't |
| // big enough to handle all attributes of an expectation. So |
| // we'll for sure specify optional attributes + parent attributes |
| // that are required for valid object comparison. Comparison of |
| // these parent attributes will include nested attributes. |
| |
| /** @cond SKIP */ |
| #define EXP_ATTR_FAMILY (1UL << 0) // 8-bit |
| #define EXP_ATTR_TIMEOUT (1UL << 1) // 32-bit |
| #define EXP_ATTR_ID (1UL << 2) // 32-bit |
| #define EXP_ATTR_HELPER_NAME (1UL << 3) // string |
| #define EXP_ATTR_ZONE (1UL << 4) // 16-bit |
| #define EXP_ATTR_FLAGS (1UL << 5) // 32-bit |
| #define EXP_ATTR_CLASS (1UL << 6) // 32-bit |
| #define EXP_ATTR_FN (1UL << 7) // String |
| // Tuples |
| #define EXP_ATTR_EXPECT_IP_SRC (1UL << 8) |
| #define EXP_ATTR_EXPECT_IP_DST (1UL << 9) |
| #define EXP_ATTR_EXPECT_L4PROTO_NUM (1UL << 10) |
| #define EXP_ATTR_EXPECT_L4PROTO_PORTS (1UL << 11) |
| #define EXP_ATTR_EXPECT_L4PROTO_ICMP (1UL << 12) |
| #define EXP_ATTR_MASTER_IP_SRC (1UL << 13) |
| #define EXP_ATTR_MASTER_IP_DST (1UL << 14) |
| #define EXP_ATTR_MASTER_L4PROTO_NUM (1UL << 15) |
| #define EXP_ATTR_MASTER_L4PROTO_PORTS (1UL << 16) |
| #define EXP_ATTR_MASTER_L4PROTO_ICMP (1UL << 17) |
| #define EXP_ATTR_MASK_IP_SRC (1UL << 18) |
| #define EXP_ATTR_MASK_IP_DST (1UL << 19) |
| #define EXP_ATTR_MASK_L4PROTO_NUM (1UL << 20) |
| #define EXP_ATTR_MASK_L4PROTO_PORTS (1UL << 21) |
| #define EXP_ATTR_MASK_L4PROTO_ICMP (1UL << 22) |
| #define EXP_ATTR_NAT_IP_SRC (1UL << 23) |
| #define EXP_ATTR_NAT_IP_DST (1UL << 24) |
| #define EXP_ATTR_NAT_L4PROTO_NUM (1UL << 25) |
| #define EXP_ATTR_NAT_L4PROTO_PORTS (1UL << 26) |
| #define EXP_ATTR_NAT_L4PROTO_ICMP (1UL << 27) |
| #define EXP_ATTR_NAT_DIR (1UL << 28) |
| /** @endcond */ |
| |
| static void exp_free_data(struct nl_object *c) |
| { |
| struct nfnl_exp *exp = (struct nfnl_exp *) c; |
| |
| if (exp == NULL) |
| return; |
| |
| nl_addr_put(exp->exp_expect.src); |
| nl_addr_put(exp->exp_expect.dst); |
| nl_addr_put(exp->exp_master.src); |
| nl_addr_put(exp->exp_master.dst); |
| nl_addr_put(exp->exp_mask.src); |
| nl_addr_put(exp->exp_mask.dst); |
| nl_addr_put(exp->exp_nat.src); |
| nl_addr_put(exp->exp_nat.dst); |
| |
| free(exp->exp_fn); |
| free(exp->exp_helper_name); |
| } |
| |
| static int exp_clone(struct nl_object *_dst, struct nl_object *_src) |
| { |
| struct nfnl_exp *dst = (struct nfnl_exp *) _dst; |
| struct nfnl_exp *src = (struct nfnl_exp *) _src; |
| struct nl_addr *addr; |
| |
| // Expectation |
| if (src->exp_expect.src) { |
| addr = nl_addr_clone(src->exp_expect.src); |
| if (!addr) |
| return -NLE_NOMEM; |
| dst->exp_expect.src = addr; |
| } |
| |
| if (src->exp_expect.dst) { |
| addr = nl_addr_clone(src->exp_expect.dst); |
| if (!addr) |
| return -NLE_NOMEM; |
| dst->exp_expect.dst = addr; |
| } |
| |
| // Master CT |
| if (src->exp_master.src) { |
| addr = nl_addr_clone(src->exp_master.src); |
| if (!addr) |
| return -NLE_NOMEM; |
| dst->exp_master.src = addr; |
| } |
| |
| if (src->exp_master.dst) { |
| addr = nl_addr_clone(src->exp_master.dst); |
| if (!addr) |
| return -NLE_NOMEM; |
| dst->exp_master.dst = addr; |
| } |
| |
| // Mask |
| if (src->exp_mask.src) { |
| addr = nl_addr_clone(src->exp_mask.src); |
| if (!addr) |
| return -NLE_NOMEM; |
| dst->exp_mask.src = addr; |
| } |
| |
| if (src->exp_mask.dst) { |
| addr = nl_addr_clone(src->exp_mask.dst); |
| if (!addr) |
| return -NLE_NOMEM; |
| dst->exp_mask.dst = addr; |
| } |
| |
| // NAT |
| if (src->exp_nat.src) { |
| addr = nl_addr_clone(src->exp_nat.src); |
| if (!addr) |
| return -NLE_NOMEM; |
| dst->exp_nat.src = addr; |
| } |
| |
| if (src->exp_nat.dst) { |
| addr = nl_addr_clone(src->exp_nat.dst); |
| if (!addr) |
| return -NLE_NOMEM; |
| dst->exp_nat.dst = addr; |
| } |
| |
| if (src->exp_fn) |
| dst->exp_fn = strdup(src->exp_fn); |
| |
| if (src->exp_helper_name) |
| dst->exp_helper_name = strdup(src->exp_helper_name); |
| |
| return 0; |
| } |
| |
| static void dump_addr(struct nl_dump_params *p, struct nl_addr *addr, int port) |
| { |
| char buf[64]; |
| |
| if (addr) |
| nl_dump(p, "%s", nl_addr2str(addr, buf, sizeof(buf))); |
| |
| if (port) |
| nl_dump(p, ":%u ", port); |
| else if (addr) |
| nl_dump(p, " "); |
| } |
| |
| static void dump_icmp(struct nl_dump_params *p, struct nfnl_exp *exp, int tuple) |
| { |
| if (nfnl_exp_test_icmp(exp, tuple)) { |
| |
| nl_dump(p, "icmp type %d ", nfnl_exp_get_icmp_type(exp, tuple)); |
| |
| nl_dump(p, "code %d ", nfnl_exp_get_icmp_code(exp, tuple)); |
| |
| nl_dump(p, "id %d ", nfnl_exp_get_icmp_id(exp, tuple)); |
| } |
| } |
| |
| static void exp_dump_tuples(struct nfnl_exp *exp, struct nl_dump_params *p) |
| { |
| struct nl_addr *tuple_src, *tuple_dst; |
| int tuple_sport, tuple_dport; |
| int i = 0; |
| char buf[64]; |
| |
| for (i = NFNL_EXP_TUPLE_EXPECT; i < NFNL_EXP_TUPLE_MAX; i++) { |
| tuple_src = NULL; |
| tuple_dst = NULL; |
| tuple_sport = 0; |
| tuple_dport = 0; |
| |
| // Test needed for NAT case |
| if (nfnl_exp_test_src(exp, i)) |
| tuple_src = nfnl_exp_get_src(exp, i); |
| if (nfnl_exp_test_dst(exp, i)) |
| tuple_dst = nfnl_exp_get_dst(exp, i); |
| |
| // Don't have tests for individual ports/types/codes/ids, |
| if (nfnl_exp_test_l4protonum(exp, i)) { |
| nl_dump(p, "%s ", |
| nl_ip_proto2str(nfnl_exp_get_l4protonum(exp, i), buf, sizeof(buf))); |
| } |
| |
| if (nfnl_exp_test_ports(exp, i)) { |
| tuple_sport = nfnl_exp_get_src_port(exp, i); |
| tuple_dport = nfnl_exp_get_dst_port(exp, i); |
| } |
| |
| dump_addr(p, tuple_src, tuple_sport); |
| dump_addr(p, tuple_dst, tuple_dport); |
| dump_icmp(p, exp, 0); |
| } |
| |
| if (nfnl_exp_test_nat_dir(exp)) |
| nl_dump(p, "nat dir %s ", exp->exp_nat_dir); |
| |
| } |
| |
| /* FIXME Compatible with /proc/net/nf_conntrack */ |
| static void exp_dump_line(struct nl_object *a, struct nl_dump_params *p) |
| { |
| struct nfnl_exp *exp = (struct nfnl_exp *) a; |
| |
| nl_new_line(p); |
| |
| exp_dump_tuples(exp, p); |
| |
| nl_dump(p, "\n"); |
| } |
| |
| static void exp_dump_details(struct nl_object *a, struct nl_dump_params *p) |
| { |
| struct nfnl_exp *exp = (struct nfnl_exp *) a; |
| char buf[64]; |
| int fp = 0; |
| |
| exp_dump_line(a, p); |
| |
| nl_dump(p, " id 0x%x ", exp->exp_id); |
| nl_dump_line(p, "family %s ", |
| nl_af2str(exp->exp_family, buf, sizeof(buf))); |
| |
| if (nfnl_exp_test_timeout(exp)) { |
| uint64_t timeout_ms = nfnl_exp_get_timeout(exp) * 1000UL; |
| nl_dump(p, "timeout %s ", |
| nl_msec2str(timeout_ms, buf, sizeof(buf))); |
| } |
| |
| if (nfnl_exp_test_helper_name(exp)) |
| nl_dump(p, "helper %s ", exp->exp_helper_name); |
| |
| if (nfnl_exp_test_fn(exp)) |
| nl_dump(p, "fn %s ", exp->exp_fn); |
| |
| if (nfnl_exp_test_class(exp)) |
| nl_dump(p, "class %u ", nfnl_exp_get_class(exp)); |
| |
| if (nfnl_exp_test_zone(exp)) |
| nl_dump(p, "zone %u ", nfnl_exp_get_zone(exp)); |
| |
| if (nfnl_exp_test_flags(exp)) |
| nl_dump(p, "<"); |
| #define PRINT_FLAG(str) \ |
| { nl_dump(p, "%s%s", fp++ ? "," : "", (str)); } |
| |
| if (exp->exp_flags & NF_CT_EXPECT_PERMANENT) |
| PRINT_FLAG("PERMANENT"); |
| if (exp->exp_flags & NF_CT_EXPECT_INACTIVE) |
| PRINT_FLAG("INACTIVE"); |
| if (exp->exp_flags & NF_CT_EXPECT_USERSPACE) |
| PRINT_FLAG("USERSPACE"); |
| #undef PRINT_FLAG |
| |
| if (nfnl_exp_test_flags(exp)) |
| nl_dump(p, ">"); |
| |
| nl_dump(p, "\n"); |
| } |
| |
| static int exp_cmp_l4proto_ports (union nfnl_exp_protodata *a, union nfnl_exp_protodata *b) { |
| // Must return 0 for match, 1 for mismatch |
| int d = 0; |
| d = ( (a->port.src != b->port.src) || |
| (a->port.dst != b->port.dst) ); |
| |
| return d; |
| } |
| |
| static int exp_cmp_l4proto_icmp (union nfnl_exp_protodata *a, union nfnl_exp_protodata *b) { |
| // Must return 0 for match, 1 for mismatch |
| int d = 0; |
| d = ( (a->icmp.code != b->icmp.code) || |
| (a->icmp.type != b->icmp.type) || |
| (a->icmp.id != b->icmp.id) ); |
| |
| return d; |
| } |
| |
| static int exp_compare(struct nl_object *_a, struct nl_object *_b, |
| uint32_t attrs, int flags) |
| { |
| struct nfnl_exp *a = (struct nfnl_exp *) _a; |
| struct nfnl_exp *b = (struct nfnl_exp *) _b; |
| int diff = 0; |
| |
| #define EXP_DIFF(ATTR, EXPR) ATTR_DIFF(attrs, EXP_ATTR_##ATTR, a, b, EXPR) |
| #define EXP_DIFF_VAL(ATTR, FIELD) EXP_DIFF(ATTR, a->FIELD != b->FIELD) |
| #define EXP_DIFF_STRING(ATTR, FIELD) EXP_DIFF(ATTR, (strcmp(a->FIELD, b->FIELD) != 0)) |
| #define EXP_DIFF_ADDR(ATTR, FIELD) \ |
| ((flags & LOOSE_COMPARISON) \ |
| ? EXP_DIFF(ATTR, nl_addr_cmp_prefix(a->FIELD, b->FIELD)) \ |
| : EXP_DIFF(ATTR, nl_addr_cmp(a->FIELD, b->FIELD))) |
| #define EXP_DIFF_L4PROTO_PORTS(ATTR, FIELD) \ |
| EXP_DIFF(ATTR, exp_cmp_l4proto_ports(&(a->FIELD), &(b->FIELD))) |
| #define EXP_DIFF_L4PROTO_ICMP(ATTR, FIELD) \ |
| EXP_DIFF(ATTR, exp_cmp_l4proto_icmp(&(a->FIELD), &(b->FIELD))) |
| |
| diff |= EXP_DIFF_VAL(FAMILY, exp_family); |
| diff |= EXP_DIFF_VAL(TIMEOUT, exp_timeout); |
| diff |= EXP_DIFF_VAL(ID, exp_id); |
| diff |= EXP_DIFF_VAL(ZONE, exp_zone); |
| diff |= EXP_DIFF_VAL(CLASS, exp_class); |
| diff |= EXP_DIFF_VAL(FLAGS, exp_flags); |
| diff |= EXP_DIFF_VAL(NAT_DIR, exp_nat_dir); |
| |
| diff |= EXP_DIFF_STRING(FN, exp_fn); |
| diff |= EXP_DIFF_STRING(HELPER_NAME, exp_helper_name); |
| |
| diff |= EXP_DIFF_ADDR(EXPECT_IP_SRC, exp_expect.src); |
| diff |= EXP_DIFF_ADDR(EXPECT_IP_DST, exp_expect.dst); |
| diff |= EXP_DIFF_VAL(EXPECT_L4PROTO_NUM, exp_expect.proto.l4protonum); |
| diff |= EXP_DIFF_L4PROTO_PORTS(EXPECT_L4PROTO_PORTS, exp_expect.proto.l4protodata); |
| diff |= EXP_DIFF_L4PROTO_ICMP(EXPECT_L4PROTO_ICMP, exp_expect.proto.l4protodata); |
| |
| diff |= EXP_DIFF_ADDR(MASTER_IP_SRC, exp_master.src); |
| diff |= EXP_DIFF_ADDR(MASTER_IP_DST, exp_master.dst); |
| diff |= EXP_DIFF_VAL(MASTER_L4PROTO_NUM, exp_master.proto.l4protonum); |
| diff |= EXP_DIFF_L4PROTO_PORTS(MASTER_L4PROTO_PORTS, exp_master.proto.l4protodata); |
| diff |= EXP_DIFF_L4PROTO_ICMP(MASTER_L4PROTO_ICMP, exp_master.proto.l4protodata); |
| |
| diff |= EXP_DIFF_ADDR(MASK_IP_SRC, exp_mask.src); |
| diff |= EXP_DIFF_ADDR(MASK_IP_DST, exp_mask.dst); |
| diff |= EXP_DIFF_VAL(MASK_L4PROTO_NUM, exp_mask.proto.l4protonum); |
| diff |= EXP_DIFF_L4PROTO_PORTS(MASK_L4PROTO_PORTS, exp_mask.proto.l4protodata); |
| diff |= EXP_DIFF_L4PROTO_ICMP(MASK_L4PROTO_ICMP, exp_mask.proto.l4protodata); |
| |
| diff |= EXP_DIFF_ADDR(NAT_IP_SRC, exp_nat.src); |
| diff |= EXP_DIFF_ADDR(NAT_IP_DST, exp_nat.dst); |
| diff |= EXP_DIFF_VAL(NAT_L4PROTO_NUM, exp_nat.proto.l4protonum); |
| diff |= EXP_DIFF_L4PROTO_PORTS(NAT_L4PROTO_PORTS, exp_nat.proto.l4protodata); |
| diff |= EXP_DIFF_L4PROTO_ICMP(NAT_L4PROTO_ICMP, exp_nat.proto.l4protodata); |
| |
| #undef EXP_DIFF |
| #undef EXP_DIFF_VAL |
| #undef EXP_DIFF_STRING |
| #undef EXP_DIFF_ADDR |
| #undef EXP_DIFF_L4PROTO_PORTS |
| #undef EXP_DIFF_L4PROTO_ICMP |
| |
| return diff; |
| } |
| |
| // CLI arguments? |
| static const struct trans_tbl exp_attrs[] = { |
| __ADD(EXP_ATTR_FAMILY, family) |
| __ADD(EXP_ATTR_TIMEOUT, timeout) |
| __ADD(EXP_ATTR_ID, id) |
| __ADD(EXP_ATTR_HELPER_NAME, helpername) |
| __ADD(EXP_ATTR_ZONE, zone) |
| __ADD(EXP_ATTR_CLASS, class) |
| __ADD(EXP_ATTR_FLAGS, flags) |
| __ADD(EXP_ATTR_FN, function) |
| __ADD(EXP_ATTR_EXPECT_IP_SRC, expectipsrc) |
| __ADD(EXP_ATTR_EXPECT_IP_DST, expectipdst) |
| __ADD(EXP_ATTR_EXPECT_L4PROTO_NUM, expectprotonum) |
| __ADD(EXP_ATTR_EXPECT_L4PROTO_PORTS, expectports) |
| __ADD(EXP_ATTR_EXPECT_L4PROTO_ICMP, expecticmp) |
| __ADD(EXP_ATTR_MASTER_IP_SRC, masteripsrc) |
| __ADD(EXP_ATTR_MASTER_IP_DST, masteripdst) |
| __ADD(EXP_ATTR_MASTER_L4PROTO_NUM, masterprotonum) |
| __ADD(EXP_ATTR_MASTER_L4PROTO_PORTS, masterports) |
| __ADD(EXP_ATTR_MASTER_L4PROTO_ICMP, mastericmp) |
| __ADD(EXP_ATTR_MASK_IP_SRC, maskipsrc) |
| __ADD(EXP_ATTR_MASK_IP_DST, maskipdst) |
| __ADD(EXP_ATTR_MASK_L4PROTO_NUM, maskprotonum) |
| __ADD(EXP_ATTR_MASK_L4PROTO_PORTS, maskports) |
| __ADD(EXP_ATTR_MASK_L4PROTO_ICMP, maskicmp) |
| __ADD(EXP_ATTR_NAT_IP_SRC, natipsrc) |
| __ADD(EXP_ATTR_NAT_IP_DST, natipdst) |
| __ADD(EXP_ATTR_NAT_L4PROTO_NUM, natprotonum) |
| __ADD(EXP_ATTR_NAT_L4PROTO_PORTS, natports) |
| __ADD(EXP_ATTR_NAT_L4PROTO_ICMP, naticmp) |
| __ADD(EXP_ATTR_NAT_DIR, natdir) |
| }; |
| |
| static char *exp_attrs2str(int attrs, char *buf, size_t len) |
| { |
| return __flags2str(attrs, buf, len, exp_attrs, ARRAY_SIZE(exp_attrs)); |
| } |
| |
| /** |
| * @name Allocation/Freeing |
| * @{ |
| */ |
| |
| struct nfnl_exp *nfnl_exp_alloc(void) |
| { |
| return (struct nfnl_exp *) nl_object_alloc(&exp_obj_ops); |
| } |
| |
| void nfnl_exp_get(struct nfnl_exp *exp) |
| { |
| nl_object_get((struct nl_object *) exp); |
| } |
| |
| void nfnl_exp_put(struct nfnl_exp *exp) |
| { |
| nl_object_put((struct nl_object *) exp); |
| } |
| |
| /** @} */ |
| |
| /** |
| * @name Attributes |
| * @{ |
| */ |
| |
| void nfnl_exp_set_family(struct nfnl_exp *exp, uint8_t family) |
| { |
| exp->exp_family = family; |
| exp->ce_mask |= EXP_ATTR_FAMILY; |
| } |
| |
| uint8_t nfnl_exp_get_family(const struct nfnl_exp *exp) |
| { |
| if (exp->ce_mask & EXP_ATTR_FAMILY) |
| return exp->exp_family; |
| else |
| return AF_UNSPEC; |
| } |
| |
| void nfnl_exp_set_flags(struct nfnl_exp *exp, uint32_t flags) |
| { |
| exp->exp_flags |= flags; |
| exp->ce_mask |= EXP_ATTR_FLAGS; |
| } |
| |
| int nfnl_exp_test_flags(const struct nfnl_exp *exp) |
| { |
| return !!(exp->ce_mask & EXP_ATTR_FLAGS); |
| } |
| |
| void nfnl_exp_unset_flags(struct nfnl_exp *exp, uint32_t flags) |
| { |
| exp->exp_flags &= ~flags; |
| exp->ce_mask |= EXP_ATTR_FLAGS; |
| } |
| |
| uint32_t nfnl_exp_get_flags(const struct nfnl_exp *exp) |
| { |
| return exp->exp_flags; |
| } |
| |
| static const struct trans_tbl flag_table[] = { |
| __ADD(IPS_EXPECTED, expected) |
| __ADD(IPS_SEEN_REPLY, seen_reply) |
| __ADD(IPS_ASSURED, assured) |
| }; |
| |
| char * nfnl_exp_flags2str(int flags, char *buf, size_t len) |
| { |
| return __flags2str(flags, buf, len, flag_table, |
| ARRAY_SIZE(flag_table)); |
| } |
| |
| int nfnl_exp_str2flags(const char *name) |
| { |
| return __str2flags(name, flag_table, ARRAY_SIZE(flag_table)); |
| } |
| |
| void nfnl_exp_set_timeout(struct nfnl_exp *exp, uint32_t timeout) |
| { |
| exp->exp_timeout = timeout; |
| exp->ce_mask |= EXP_ATTR_TIMEOUT; |
| } |
| |
| int nfnl_exp_test_timeout(const struct nfnl_exp *exp) |
| { |
| return !!(exp->ce_mask & EXP_ATTR_TIMEOUT); |
| } |
| |
| uint32_t nfnl_exp_get_timeout(const struct nfnl_exp *exp) |
| { |
| return exp->exp_timeout; |
| } |
| |
| void nfnl_exp_set_id(struct nfnl_exp *exp, uint32_t id) |
| { |
| exp->exp_id = id; |
| exp->ce_mask |= EXP_ATTR_ID; |
| } |
| |
| int nfnl_exp_test_id(const struct nfnl_exp *exp) |
| { |
| return !!(exp->ce_mask & EXP_ATTR_ID); |
| } |
| |
| uint32_t nfnl_exp_get_id(const struct nfnl_exp *exp) |
| { |
| return exp->exp_id; |
| } |
| |
| int nfnl_exp_set_helper_name(struct nfnl_exp *exp, void *name) |
| { |
| free(exp->exp_helper_name); |
| exp->exp_helper_name = strdup(name); |
| if (!exp->exp_helper_name) |
| return -NLE_NOMEM; |
| |
| exp->ce_mask |= EXP_ATTR_HELPER_NAME; |
| return 0; |
| } |
| |
| int nfnl_exp_test_helper_name(const struct nfnl_exp *exp) |
| { |
| return !!(exp->ce_mask & EXP_ATTR_HELPER_NAME); |
| } |
| |
| const char * nfnl_exp_get_helper_name(const struct nfnl_exp *exp) |
| { |
| return exp->exp_helper_name; |
| } |
| |
| void nfnl_exp_set_zone(struct nfnl_exp *exp, uint16_t zone) |
| { |
| exp->exp_zone = zone; |
| exp->ce_mask |= EXP_ATTR_ZONE; |
| } |
| |
| int nfnl_exp_test_zone(const struct nfnl_exp *exp) |
| { |
| return !!(exp->ce_mask & EXP_ATTR_ZONE); |
| } |
| |
| uint16_t nfnl_exp_get_zone(const struct nfnl_exp *exp) |
| { |
| return exp->exp_zone; |
| } |
| |
| void nfnl_exp_set_class(struct nfnl_exp *exp, uint32_t class) |
| { |
| exp->exp_class = class; |
| exp->ce_mask |= EXP_ATTR_CLASS; |
| } |
| |
| int nfnl_exp_test_class(const struct nfnl_exp *exp) |
| { |
| return !!(exp->ce_mask & EXP_ATTR_CLASS); |
| } |
| |
| uint32_t nfnl_exp_get_class(const struct nfnl_exp *exp) |
| { |
| return exp->exp_class; |
| } |
| |
| int nfnl_exp_set_fn(struct nfnl_exp *exp, void *fn) |
| { |
| free(exp->exp_fn); |
| exp->exp_fn = strdup(fn); |
| if (!exp->exp_fn) |
| return -NLE_NOMEM; |
| |
| exp->ce_mask |= EXP_ATTR_FN; |
| return 0; |
| } |
| |
| int nfnl_exp_test_fn(const struct nfnl_exp *exp) |
| { |
| return !!(exp->ce_mask & EXP_ATTR_FN); |
| } |
| |
| const char * nfnl_exp_get_fn(const struct nfnl_exp *exp) |
| { |
| return exp->exp_fn; |
| } |
| |
| void nfnl_exp_set_nat_dir(struct nfnl_exp *exp, uint8_t nat_dir) |
| { |
| exp->exp_nat_dir = nat_dir; |
| exp->ce_mask |= EXP_ATTR_NAT_DIR; |
| } |
| |
| int nfnl_exp_test_nat_dir(const struct nfnl_exp *exp) |
| { |
| return !!(exp->ce_mask & EXP_ATTR_NAT_DIR); |
| } |
| |
| uint8_t nfnl_exp_get_nat_dir(const struct nfnl_exp *exp) |
| { |
| return exp->exp_nat_dir; |
| } |
| |
| #define EXP_GET_TUPLE(e, t) \ |
| (t == NFNL_EXP_TUPLE_MASTER) ? \ |
| &(e->exp_master) : \ |
| (t == NFNL_EXP_TUPLE_MASK) ? \ |
| &(e->exp_mask) : \ |
| (t == NFNL_EXP_TUPLE_NAT) ? \ |
| &(e->exp_nat) : &(exp->exp_expect) |
| |
| static int exp_get_src_attr(int tuple) |
| { |
| int attr = 0; |
| |
| switch (tuple) { |
| case NFNL_EXP_TUPLE_MASTER: |
| attr = EXP_ATTR_MASTER_IP_SRC; |
| break; |
| case NFNL_EXP_TUPLE_MASK: |
| attr = EXP_ATTR_MASK_IP_SRC; |
| break; |
| case NFNL_EXP_TUPLE_NAT: |
| attr = EXP_ATTR_NAT_IP_SRC; |
| break; |
| case NFNL_EXP_TUPLE_EXPECT: |
| default : |
| attr = EXP_ATTR_EXPECT_IP_SRC; |
| } |
| |
| return attr; |
| } |
| |
| static int exp_get_dst_attr(int tuple) |
| { |
| int attr = 0; |
| |
| switch (tuple) { |
| case NFNL_EXP_TUPLE_MASTER: |
| attr = EXP_ATTR_MASTER_IP_DST; |
| break; |
| case NFNL_EXP_TUPLE_MASK: |
| attr = EXP_ATTR_MASK_IP_DST; |
| break; |
| case NFNL_EXP_TUPLE_NAT: |
| attr = EXP_ATTR_NAT_IP_DST; |
| break; |
| case NFNL_EXP_TUPLE_EXPECT: |
| default : |
| attr = EXP_ATTR_EXPECT_IP_DST; |
| } |
| |
| return attr; |
| } |
| |
| |
| static int exp_set_addr(struct nfnl_exp *exp, struct nl_addr *addr, |
| int attr, struct nl_addr ** exp_addr) |
| { |
| if (exp->ce_mask & EXP_ATTR_FAMILY) { |
| if (addr->a_family != exp->exp_family) |
| return -NLE_AF_MISMATCH; |
| } else |
| nfnl_exp_set_family(exp, addr->a_family); |
| |
| if (*exp_addr) |
| nl_addr_put(*exp_addr); |
| |
| nl_addr_get(addr); |
| *exp_addr = addr; |
| exp->ce_mask |= attr; |
| |
| return 0; |
| } |
| |
| int nfnl_exp_set_src(struct nfnl_exp *exp, int tuple, struct nl_addr *addr) |
| { |
| struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple); |
| |
| return exp_set_addr(exp, addr, exp_get_src_attr(tuple), &dir->src); |
| } |
| |
| int nfnl_exp_set_dst(struct nfnl_exp *exp, int tuple, struct nl_addr *addr) |
| { |
| struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple); |
| |
| return exp_set_addr(exp, addr, exp_get_dst_attr(tuple), &dir->dst); |
| } |
| |
| int nfnl_exp_test_src(const struct nfnl_exp *exp, int tuple) |
| { |
| return !!(exp->ce_mask & exp_get_src_attr(tuple)); |
| } |
| |
| int nfnl_exp_test_dst(const struct nfnl_exp *exp, int tuple) |
| { |
| return !!(exp->ce_mask & exp_get_dst_attr(tuple)); |
| } |
| |
| struct nl_addr *nfnl_exp_get_src(const struct nfnl_exp *exp, int tuple) |
| { |
| const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple); |
| |
| if (!(exp->ce_mask & exp_get_src_attr(tuple))) |
| return NULL; |
| return dir->src; |
| } |
| |
| struct nl_addr *nfnl_exp_get_dst(const struct nfnl_exp *exp, int tuple) |
| { |
| const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple); |
| |
| if (!(exp->ce_mask & exp_get_dst_attr(tuple))) |
| return NULL; |
| return dir->dst; |
| } |
| |
| static int exp_get_l4protonum_attr(int tuple) |
| { |
| int attr = 0; |
| |
| switch (tuple) { |
| case NFNL_EXP_TUPLE_MASTER: |
| attr = EXP_ATTR_MASTER_L4PROTO_NUM; |
| break; |
| case NFNL_EXP_TUPLE_MASK: |
| attr = EXP_ATTR_MASK_L4PROTO_NUM; |
| break; |
| case NFNL_EXP_TUPLE_NAT: |
| attr = EXP_ATTR_NAT_L4PROTO_NUM; |
| break; |
| case NFNL_EXP_TUPLE_EXPECT: |
| default : |
| attr = EXP_ATTR_EXPECT_L4PROTO_NUM; |
| } |
| |
| return attr; |
| } |
| |
| void nfnl_exp_set_l4protonum(struct nfnl_exp *exp, int tuple, uint8_t l4protonum) |
| { |
| struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple); |
| |
| dir->proto.l4protonum = l4protonum; |
| exp->ce_mask |= exp_get_l4protonum_attr(tuple); |
| } |
| |
| int nfnl_exp_test_l4protonum(const struct nfnl_exp *exp, int tuple) |
| { |
| return !!(exp->ce_mask & exp_get_l4protonum_attr(tuple)); |
| } |
| |
| uint8_t nfnl_exp_get_l4protonum(const struct nfnl_exp *exp, int tuple) |
| { |
| const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple); |
| return dir->proto.l4protonum; |
| } |
| |
| static int exp_get_l4ports_attr(int tuple) |
| { |
| int attr = 0; |
| |
| switch (tuple) { |
| case NFNL_EXP_TUPLE_MASTER: |
| attr = EXP_ATTR_MASTER_L4PROTO_PORTS; |
| break; |
| case NFNL_EXP_TUPLE_MASK: |
| attr = EXP_ATTR_MASK_L4PROTO_PORTS; |
| break; |
| case NFNL_EXP_TUPLE_NAT: |
| attr = EXP_ATTR_NAT_L4PROTO_PORTS; |
| break; |
| case NFNL_EXP_TUPLE_EXPECT: |
| default : |
| attr = EXP_ATTR_EXPECT_L4PROTO_PORTS; |
| } |
| |
| return attr; |
| } |
| |
| void nfnl_exp_set_ports(struct nfnl_exp *exp, int tuple, uint16_t srcport, uint16_t dstport) |
| { |
| struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple); |
| |
| dir->proto.l4protodata.port.src = srcport; |
| dir->proto.l4protodata.port.dst = dstport; |
| |
| exp->ce_mask |= exp_get_l4ports_attr(tuple); |
| } |
| |
| int nfnl_exp_test_ports(const struct nfnl_exp *exp, int tuple) |
| { |
| return !!(exp->ce_mask & exp_get_l4ports_attr(tuple)); |
| } |
| |
| uint16_t nfnl_exp_get_src_port(const struct nfnl_exp *exp, int tuple) |
| { |
| const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple); |
| return dir->proto.l4protodata.port.src; |
| } |
| |
| uint16_t nfnl_exp_get_dst_port(const struct nfnl_exp *exp, int tuple) |
| { |
| const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple); |
| |
| return dir->proto.l4protodata.port.dst; |
| } |
| |
| static int exp_get_l4icmp_attr(int tuple) |
| { |
| int attr = 0; |
| |
| switch (tuple) { |
| case NFNL_EXP_TUPLE_MASTER: |
| attr = EXP_ATTR_MASTER_L4PROTO_ICMP; |
| break; |
| case NFNL_EXP_TUPLE_MASK: |
| attr = EXP_ATTR_MASK_L4PROTO_ICMP; |
| break; |
| case NFNL_EXP_TUPLE_NAT: |
| attr = EXP_ATTR_NAT_L4PROTO_ICMP; |
| break; |
| case NFNL_EXP_TUPLE_EXPECT: |
| default : |
| attr = EXP_ATTR_EXPECT_L4PROTO_ICMP; |
| } |
| |
| return attr; |
| } |
| |
| void nfnl_exp_set_icmp(struct nfnl_exp *exp, int tuple, uint16_t id, uint8_t type, uint8_t code) |
| { |
| struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple); |
| |
| dir->proto.l4protodata.icmp.id = id; |
| dir->proto.l4protodata.icmp.type = type; |
| dir->proto.l4protodata.icmp.code = code; |
| |
| exp->ce_mask |= exp_get_l4icmp_attr(tuple); |
| } |
| |
| int nfnl_exp_test_icmp(const struct nfnl_exp *exp, int tuple) |
| { |
| int attr = exp_get_l4icmp_attr(tuple); |
| return !!(exp->ce_mask & attr); |
| } |
| |
| uint16_t nfnl_exp_get_icmp_id(const struct nfnl_exp *exp, int tuple) |
| { |
| const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple); |
| |
| return dir->proto.l4protodata.icmp.id; |
| } |
| |
| uint8_t nfnl_exp_get_icmp_type(const struct nfnl_exp *exp, int tuple) |
| { |
| const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple); |
| |
| return dir->proto.l4protodata.icmp.type; |
| } |
| |
| uint8_t nfnl_exp_get_icmp_code(const struct nfnl_exp *exp, int tuple) |
| { |
| const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple); |
| |
| return dir->proto.l4protodata.icmp.code; |
| } |
| |
| /** @} */ |
| |
| struct nl_object_ops exp_obj_ops = { |
| .oo_name = "netfilter/exp", |
| .oo_size = sizeof(struct nfnl_exp), |
| .oo_free_data = exp_free_data, |
| .oo_clone = exp_clone, |
| .oo_dump = { |
| [NL_DUMP_LINE] = exp_dump_line, |
| [NL_DUMP_DETAILS] = exp_dump_details, |
| }, |
| .oo_compare = exp_compare, |
| .oo_attrs2str = exp_attrs2str, |
| }; |
| |
| /** @} */ |