libnl 3.11.0
ct_obj.c
1/* SPDX-License-Identifier: LGPL-2.1-only */
2/*
3 * Copyright (c) 2003-2008 Thomas Graf <tgraf@suug.ch>
4 * Copyright (c) 2007 Philip Craig <philipc@snapgear.com>
5 * Copyright (c) 2007 Secure Computing Corporation
6 */
7
8#include "nl-default.h"
9
10#include <sys/types.h>
11
12#include <linux/netfilter/nfnetlink_conntrack.h>
13#include <linux/netfilter/nf_conntrack_common.h>
14
15#include <linux/netfilter/nf_conntrack_tcp.h>
16
17#include <netlink/netfilter/nfnl.h>
18#include <netlink/netfilter/ct.h>
19
20#include "nl-priv-dynamic-core/object-api.h"
21#include "nl-netfilter.h"
22#include "nl-priv-dynamic-core/nl-core.h"
23
24/** @cond SKIP */
25#define CT_ATTR_FAMILY (1UL << 0)
26#define CT_ATTR_PROTO (1UL << 1)
27
28#define CT_ATTR_TCP_STATE (1UL << 2)
29
30#define CT_ATTR_STATUS (1UL << 3)
31#define CT_ATTR_TIMEOUT (1UL << 4)
32#define CT_ATTR_MARK (1UL << 5)
33#define CT_ATTR_USE (1UL << 6)
34#define CT_ATTR_ID (1UL << 7)
35
36#define CT_ATTR_ORIG_SRC (1UL << 8)
37#define CT_ATTR_ORIG_DST (1UL << 9)
38#define CT_ATTR_ORIG_SRC_PORT (1UL << 10)
39#define CT_ATTR_ORIG_DST_PORT (1UL << 11)
40#define CT_ATTR_ORIG_ICMP_ID (1UL << 12)
41#define CT_ATTR_ORIG_ICMP_TYPE (1UL << 13)
42#define CT_ATTR_ORIG_ICMP_CODE (1UL << 14)
43#define CT_ATTR_ORIG_PACKETS (1UL << 15)
44#define CT_ATTR_ORIG_BYTES (1UL << 16)
45
46#define CT_ATTR_REPL_SRC (1UL << 17)
47#define CT_ATTR_REPL_DST (1UL << 18)
48#define CT_ATTR_REPL_SRC_PORT (1UL << 19)
49#define CT_ATTR_REPL_DST_PORT (1UL << 20)
50#define CT_ATTR_REPL_ICMP_ID (1UL << 21)
51#define CT_ATTR_REPL_ICMP_TYPE (1UL << 22)
52#define CT_ATTR_REPL_ICMP_CODE (1UL << 23)
53#define CT_ATTR_REPL_PACKETS (1UL << 24)
54#define CT_ATTR_REPL_BYTES (1UL << 25)
55#define CT_ATTR_TIMESTAMP (1UL << 26)
56#define CT_ATTR_ZONE (1UL << 27)
57/** @endcond */
58
59static void ct_free_data(struct nl_object *c)
60{
61 struct nfnl_ct *ct = (struct nfnl_ct *) c;
62
63 if (ct == NULL)
64 return;
65
66 nl_addr_put(ct->ct_orig.src);
67 nl_addr_put(ct->ct_orig.dst);
68 nl_addr_put(ct->ct_repl.src);
69 nl_addr_put(ct->ct_repl.dst);
70}
71
72static int ct_clone(struct nl_object *_dst, struct nl_object *_src)
73{
74 struct nfnl_ct *dst = (struct nfnl_ct *) _dst;
75 struct nfnl_ct *src = (struct nfnl_ct *) _src;
76 struct nl_addr *addr;
77
78 dst->ct_orig.src = NULL;
79 dst->ct_orig.dst = NULL;
80 dst->ct_repl.src = NULL;
81 dst->ct_repl.dst = NULL;
82
83 if (src->ct_orig.src) {
84 addr = nl_addr_clone(src->ct_orig.src);
85 if (!addr)
86 return -NLE_NOMEM;
87 dst->ct_orig.src = addr;
88 }
89
90 if (src->ct_orig.dst) {
91 addr = nl_addr_clone(src->ct_orig.dst);
92 if (!addr)
93 return -NLE_NOMEM;
94 dst->ct_orig.dst = addr;
95 }
96
97 if (src->ct_repl.src) {
98 addr = nl_addr_clone(src->ct_repl.src);
99 if (!addr)
100 return -NLE_NOMEM;
101 dst->ct_repl.src = addr;
102 }
103
104 if (src->ct_repl.dst) {
105 addr = nl_addr_clone(src->ct_repl.dst);
106 if (!addr)
107 return -NLE_NOMEM;
108 dst->ct_repl.dst = addr;
109 }
110
111 return 0;
112}
113
114static void dump_addr(struct nl_dump_params *p, struct nl_addr *addr, int port)
115{
116 char buf[64];
117
118 if (addr)
119 nl_dump(p, "%s", nl_addr2str(addr, buf, sizeof(buf)));
120
121 if (port)
122 nl_dump(p, ":%u ", port);
123 else if (addr)
124 nl_dump(p, " ");
125}
126
127static void dump_icmp(struct nl_dump_params *p, struct nfnl_ct *ct, int reply)
128{
129 if (nfnl_ct_test_icmp_type(ct, reply))
130 nl_dump(p, "icmp type %d ", nfnl_ct_get_icmp_type(ct, reply));
131
132 if (nfnl_ct_test_icmp_code(ct, reply))
133 nl_dump(p, "code %d ", nfnl_ct_get_icmp_code(ct, reply));
134
135 if (nfnl_ct_test_icmp_id(ct, reply))
136 nl_dump(p, "id %d ", nfnl_ct_get_icmp_id(ct, reply));
137}
138
139static void ct_dump_tuples(struct nfnl_ct *ct, struct nl_dump_params *p)
140{
141 struct nl_addr *orig_src, *orig_dst, *reply_src, *reply_dst;
142 int orig_sport = 0, orig_dport = 0, reply_sport = 0, reply_dport = 0;
143 int sync = 0;
144
145 orig_src = nfnl_ct_get_src(ct, 0);
146 orig_dst = nfnl_ct_get_dst(ct, 0);
147 reply_src = nfnl_ct_get_src(ct, 1);
148 reply_dst = nfnl_ct_get_dst(ct, 1);
149
150 if (nfnl_ct_test_src_port(ct, 0))
151 orig_sport = nfnl_ct_get_src_port(ct, 0);
152
153 if (nfnl_ct_test_dst_port(ct, 0))
154 orig_dport = nfnl_ct_get_dst_port(ct, 0);
155
156 if (nfnl_ct_test_src_port(ct, 1))
157 reply_sport = nfnl_ct_get_src_port(ct, 1);
158
159 if (nfnl_ct_test_dst_port(ct, 1))
160 reply_dport = nfnl_ct_get_dst_port(ct, 1);
161
162 if (orig_src && orig_dst && reply_src && reply_dst &&
163 orig_sport == reply_dport && orig_dport == reply_sport &&
164 !nl_addr_cmp(orig_src, reply_dst) &&
165 !nl_addr_cmp(orig_dst, reply_src))
166 sync = 1;
167
168 dump_addr(p, orig_src, orig_sport);
169 nl_dump(p, sync ? "<-> " : "-> ");
170 dump_addr(p, orig_dst, orig_dport);
171 dump_icmp(p, ct, 0);
172
173 if (!sync) {
174 dump_addr(p, reply_src, reply_sport);
175 nl_dump(p, "<- ");
176 dump_addr(p, reply_dst, reply_dport);
177 dump_icmp(p, ct, 1);
178 }
179}
180
181/* Compatible with /proc/net/nf_conntrack */
182static void ct_dump_line(struct nl_object *a, struct nl_dump_params *p)
183{
184 struct nfnl_ct *ct = (struct nfnl_ct *) a;
185 char buf[64];
186
187 nl_new_line(p);
188
189 if (nfnl_ct_test_proto(ct))
190 nl_dump(p, "%s ",
191 nl_ip_proto2str(nfnl_ct_get_proto(ct), buf, sizeof(buf)));
192
193 if (nfnl_ct_test_tcp_state(ct))
194 nl_dump(p, "%s ",
195 nfnl_ct_tcp_state2str(nfnl_ct_get_tcp_state(ct),
196 buf, sizeof(buf)));
197
198 ct_dump_tuples(ct, p);
199
200 if (nfnl_ct_test_mark(ct) && nfnl_ct_get_mark(ct))
201 nl_dump(p, "mark %u ", nfnl_ct_get_mark(ct));
202
203 if (nfnl_ct_test_zone(ct))
204 nl_dump(p, "zone %hu ", nfnl_ct_get_zone(ct));
205
206 if (nfnl_ct_test_timestamp(ct)) {
207 const struct nfnl_ct_timestamp *tstamp = nfnl_ct_get_timestamp(ct);
208 int64_t delta_time = tstamp->stop - tstamp->start;
209
210 if (delta_time > 0)
211 delta_time /= NSEC_PER_SEC;
212 else
213 delta_time = 0;
214 nl_dump(p, "delta-time %llu ", (long long unsigned)delta_time);
215 }
216
217 nl_dump(p, "\n");
218}
219
220static void ct_dump_details(struct nl_object *a, struct nl_dump_params *p)
221{
222 struct nfnl_ct *ct = (struct nfnl_ct *) a;
223 char buf[64];
224 int fp = 0;
225
226 ct_dump_line(a, p);
227
228 nl_dump(p, " id 0x%x ", ct->ct_id);
229 if (ct->ce_mask & CT_ATTR_FAMILY)
230 nl_dump_line(p, "family %s ",
231 nl_af2str(ct->ct_family, buf, sizeof(buf)));
232
233 if (nfnl_ct_test_use(ct))
234 nl_dump(p, "refcnt %u ", nfnl_ct_get_use(ct));
235
236 if (nfnl_ct_test_timeout(ct)) {
237 uint64_t timeout_ms = nfnl_ct_get_timeout(ct) * 1000UL;
238 nl_dump(p, "timeout %s ",
239 nl_msec2str(timeout_ms, buf, sizeof(buf)));
240 }
241
242 if (ct->ct_status)
243 nl_dump(p, "<");
244
245#define PRINT_FLAG(str) \
246 { nl_dump(p, "%s%s", fp++ ? "," : "", (str)); }
247
248 if (ct->ct_status & IPS_EXPECTED)
249 PRINT_FLAG("EXPECTED");
250 if (!(ct->ct_status & IPS_SEEN_REPLY))
251 PRINT_FLAG("NOREPLY");
252 if (ct->ct_status & IPS_ASSURED)
253 PRINT_FLAG("ASSURED");
254 if (!(ct->ct_status & IPS_CONFIRMED))
255 PRINT_FLAG("NOTSENT");
256 if (ct->ct_status & IPS_SRC_NAT)
257 PRINT_FLAG("SNAT");
258 if (ct->ct_status & IPS_DST_NAT)
259 PRINT_FLAG("DNAT");
260 if (ct->ct_status & IPS_SEQ_ADJUST)
261 PRINT_FLAG("SEQADJUST");
262 if (!(ct->ct_status & IPS_SRC_NAT_DONE))
263 PRINT_FLAG("SNAT_INIT");
264 if (!(ct->ct_status & IPS_DST_NAT_DONE))
265 PRINT_FLAG("DNAT_INIT");
266 if (ct->ct_status & IPS_DYING)
267 PRINT_FLAG("DYING");
268 if (ct->ct_status & IPS_FIXED_TIMEOUT)
269 PRINT_FLAG("FIXED_TIMEOUT");
270#undef PRINT_FLAG
271
272 if (ct->ct_status)
273 nl_dump(p, ">");
274 nl_dump(p, "\n");
275}
276
277static void ct_dump_stats(struct nl_object *a, struct nl_dump_params *p)
278{
279 struct nfnl_ct *ct = (struct nfnl_ct *) a;
280 double res;
281 char *unit;
282 uint64_t packets;
283 const char * const names[] = {"rx", "tx"};
284 int i;
285
286 ct_dump_details(a, p);
287
288 if (!nfnl_ct_test_bytes(ct, 0) ||
289 !nfnl_ct_test_packets(ct, 0) ||
290 !nfnl_ct_test_bytes(ct, 1) ||
291 !nfnl_ct_test_packets(ct, 1))
292 {
293 nl_dump_line(p, " Statistics are not available.\n");
294 nl_dump_line(p, " Please set sysctl net.netfilter.nf_conntrack_acct=1\n");
295 nl_dump_line(p, " (Require kernel 2.6.27)\n");
296 return;
297 }
298
299 nl_dump_line(p, " # packets volume\n");
300 for (i=0; i<=1; i++) {
301 res = nl_cancel_down_bytes(nfnl_ct_get_bytes(ct, i), &unit);
302 packets = nfnl_ct_get_packets(ct, i);
303 nl_dump_line(p, " %s %10" PRIu64 " %7.2f %s\n", names[i], packets, res, unit);
304 }
305}
306
307static uint64_t ct_compare(struct nl_object *_a, struct nl_object *_b,
308 uint64_t attrs, int flags)
309{
310 struct nfnl_ct *a = (struct nfnl_ct *) _a;
311 struct nfnl_ct *b = (struct nfnl_ct *) _b;
312 uint64_t diff = 0;
313
314#define _DIFF(ATTR, EXPR) ATTR_DIFF(attrs, ATTR, a, b, EXPR)
315#define _DIFF_VAL(ATTR, FIELD) _DIFF(ATTR, a->FIELD != b->FIELD)
316#define _DIFF_ADDR(ATTR, FIELD) \
317 ((flags & LOOSE_COMPARISON) ? \
318 _DIFF(ATTR, nl_addr_cmp_prefix(a->FIELD, b->FIELD)) : \
319 _DIFF(ATTR, nl_addr_cmp(a->FIELD, b->FIELD)))
320 diff |= _DIFF_VAL(CT_ATTR_FAMILY, ct_family);
321 diff |= _DIFF_VAL(CT_ATTR_PROTO, ct_proto);
322 diff |= _DIFF_VAL(CT_ATTR_TCP_STATE, ct_protoinfo.tcp.state);
323 diff |= _DIFF_VAL(CT_ATTR_TIMEOUT, ct_timeout);
324 diff |= _DIFF_VAL(CT_ATTR_MARK, ct_mark);
325 diff |= _DIFF_VAL(CT_ATTR_USE, ct_use);
326 diff |= _DIFF_VAL(CT_ATTR_ID, ct_id);
327 diff |= _DIFF_ADDR(CT_ATTR_ORIG_SRC, ct_orig.src);
328 diff |= _DIFF_ADDR(CT_ATTR_ORIG_DST, ct_orig.dst);
329 diff |= _DIFF_VAL(CT_ATTR_ORIG_SRC_PORT, ct_orig.proto.port.src);
330 diff |= _DIFF_VAL(CT_ATTR_ORIG_DST_PORT, ct_orig.proto.port.dst);
331 diff |= _DIFF_VAL(CT_ATTR_ORIG_ICMP_ID, ct_orig.proto.icmp.id);
332 diff |= _DIFF_VAL(CT_ATTR_ORIG_ICMP_TYPE, ct_orig.proto.icmp.type);
333 diff |= _DIFF_VAL(CT_ATTR_ORIG_ICMP_CODE, ct_orig.proto.icmp.code);
334 diff |= _DIFF_VAL(CT_ATTR_ORIG_PACKETS, ct_orig.packets);
335 diff |= _DIFF_VAL(CT_ATTR_ORIG_BYTES, ct_orig.bytes);
336 diff |= _DIFF_ADDR(CT_ATTR_REPL_SRC, ct_repl.src);
337 diff |= _DIFF_ADDR(CT_ATTR_REPL_DST, ct_repl.dst);
338 diff |= _DIFF_VAL(CT_ATTR_REPL_SRC_PORT, ct_repl.proto.port.src);
339 diff |= _DIFF_VAL(CT_ATTR_REPL_DST_PORT, ct_repl.proto.port.dst);
340 diff |= _DIFF_VAL(CT_ATTR_REPL_ICMP_ID, ct_repl.proto.icmp.id);
341 diff |= _DIFF_VAL(CT_ATTR_REPL_ICMP_TYPE, ct_repl.proto.icmp.type);
342 diff |= _DIFF_VAL(CT_ATTR_REPL_ICMP_CODE, ct_repl.proto.icmp.code);
343 diff |= _DIFF_VAL(CT_ATTR_REPL_PACKETS, ct_repl.packets);
344 diff |= _DIFF_VAL(CT_ATTR_REPL_BYTES, ct_repl.bytes);
345
346 if (flags & LOOSE_COMPARISON)
347 diff |= _DIFF(CT_ATTR_STATUS, (a->ct_status ^ b->ct_status) &
348 b->ct_status_mask);
349 else
350 diff |= _DIFF(CT_ATTR_STATUS, a->ct_status != b->ct_status);
351#undef _DIFF
352#undef _DIFF_VAL
353#undef _DIFF_ADDR
354
355 return diff;
356}
357
358static const struct trans_tbl ct_attrs[] = {
359 __ADD(CT_ATTR_FAMILY, family),
360 __ADD(CT_ATTR_PROTO, proto),
361 __ADD(CT_ATTR_TCP_STATE, tcpstate),
362 __ADD(CT_ATTR_STATUS, status),
363 __ADD(CT_ATTR_TIMEOUT, timeout),
364 __ADD(CT_ATTR_MARK, mark),
365 __ADD(CT_ATTR_USE, use),
366 __ADD(CT_ATTR_ID, id),
367 __ADD(CT_ATTR_ORIG_SRC, origsrc),
368 __ADD(CT_ATTR_ORIG_DST, origdst),
369 __ADD(CT_ATTR_ORIG_SRC_PORT, origsrcport),
370 __ADD(CT_ATTR_ORIG_DST_PORT, origdstport),
371 __ADD(CT_ATTR_ORIG_ICMP_ID, origicmpid),
372 __ADD(CT_ATTR_ORIG_ICMP_TYPE, origicmptype),
373 __ADD(CT_ATTR_ORIG_ICMP_CODE, origicmpcode),
374 __ADD(CT_ATTR_ORIG_PACKETS, origpackets),
375 __ADD(CT_ATTR_ORIG_BYTES, origbytes),
376 __ADD(CT_ATTR_REPL_SRC, replysrc),
377 __ADD(CT_ATTR_REPL_DST, replydst),
378 __ADD(CT_ATTR_REPL_SRC_PORT, replysrcport),
379 __ADD(CT_ATTR_REPL_DST_PORT, replydstport),
380 __ADD(CT_ATTR_REPL_ICMP_ID, replyicmpid),
381 __ADD(CT_ATTR_REPL_ICMP_TYPE, replyicmptype),
382 __ADD(CT_ATTR_REPL_ICMP_CODE, replyicmpcode),
383 __ADD(CT_ATTR_REPL_PACKETS, replypackets),
384 __ADD(CT_ATTR_REPL_BYTES, replybytes),
385};
386
387static char *ct_attrs2str(int attrs, char *buf, size_t len)
388{
389 return __flags2str(attrs, buf, len, ct_attrs, ARRAY_SIZE(ct_attrs));
390}
391
392/**
393 * @name Allocation/Freeing
394 * @{
395 */
396
397struct nfnl_ct *nfnl_ct_alloc(void)
398{
399 return (struct nfnl_ct *) nl_object_alloc(&ct_obj_ops);
400}
401
402void nfnl_ct_get(struct nfnl_ct *ct)
403{
404 nl_object_get((struct nl_object *) ct);
405}
406
407void nfnl_ct_put(struct nfnl_ct *ct)
408{
409 nl_object_put((struct nl_object *) ct);
410}
411
412/** @} */
413
414/**
415 * @name Attributes
416 * @{
417 */
418
419void nfnl_ct_set_family(struct nfnl_ct *ct, uint8_t family)
420{
421 ct->ct_family = family;
422 ct->ce_mask |= CT_ATTR_FAMILY;
423}
424
425uint8_t nfnl_ct_get_family(const struct nfnl_ct *ct)
426{
427 if (ct->ce_mask & CT_ATTR_FAMILY)
428 return ct->ct_family;
429 else
430 return AF_UNSPEC;
431}
432
433void nfnl_ct_set_proto(struct nfnl_ct *ct, uint8_t proto)
434{
435 ct->ct_proto = proto;
436 ct->ce_mask |= CT_ATTR_PROTO;
437}
438
439int nfnl_ct_test_proto(const struct nfnl_ct *ct)
440{
441 return !!(ct->ce_mask & CT_ATTR_PROTO);
442}
443
444uint8_t nfnl_ct_get_proto(const struct nfnl_ct *ct)
445{
446 return ct->ct_proto;
447}
448
449void nfnl_ct_set_tcp_state(struct nfnl_ct *ct, uint8_t state)
450{
451 ct->ct_protoinfo.tcp.state = state;
452 ct->ce_mask |= CT_ATTR_TCP_STATE;
453}
454
455int nfnl_ct_test_tcp_state(const struct nfnl_ct *ct)
456{
457 return !!(ct->ce_mask & CT_ATTR_TCP_STATE);
458}
459
460uint8_t nfnl_ct_get_tcp_state(const struct nfnl_ct *ct)
461{
462 return ct->ct_protoinfo.tcp.state;
463}
464
465static const struct trans_tbl tcp_states[] = {
466 __ADD(TCP_CONNTRACK_NONE,NONE),
467 __ADD(TCP_CONNTRACK_SYN_SENT,SYN_SENT),
468 __ADD(TCP_CONNTRACK_SYN_RECV,SYN_RECV),
469 __ADD(TCP_CONNTRACK_ESTABLISHED,ESTABLISHED),
470 __ADD(TCP_CONNTRACK_FIN_WAIT,FIN_WAIT),
471 __ADD(TCP_CONNTRACK_CLOSE_WAIT,CLOSE_WAIT),
472 __ADD(TCP_CONNTRACK_LAST_ACK,LAST_ACK),
473 __ADD(TCP_CONNTRACK_TIME_WAIT,TIME_WAIT),
474 __ADD(TCP_CONNTRACK_CLOSE,CLOSE),
475 __ADD(TCP_CONNTRACK_LISTEN,LISTEN),
476};
477
478char *nfnl_ct_tcp_state2str(uint8_t state, char *buf, size_t len)
479{
480 return __type2str(state, buf, len, tcp_states, ARRAY_SIZE(tcp_states));
481}
482
483int nfnl_ct_str2tcp_state(const char *name)
484{
485 return __str2type(name, tcp_states, ARRAY_SIZE(tcp_states));
486}
487
488void nfnl_ct_set_status(struct nfnl_ct *ct, uint32_t status)
489{
490 ct->ct_status_mask |= status;
491 ct->ct_status |= status;
492 ct->ce_mask |= CT_ATTR_STATUS;
493}
494
495void nfnl_ct_unset_status(struct nfnl_ct *ct, uint32_t status)
496{
497 ct->ct_status_mask |= status;
498 ct->ct_status &= ~status;
499 ct->ce_mask |= CT_ATTR_STATUS;
500}
501
502int nfnl_ct_test_status(const struct nfnl_ct *ct)
503{
504 return !!(ct->ce_mask & CT_ATTR_STATUS);
505}
506
507uint32_t nfnl_ct_get_status(const struct nfnl_ct *ct)
508{
509 return ct->ct_status;
510}
511
512static const struct trans_tbl status_flags[] = {
513 __ADD(IPS_EXPECTED, expected),
514 __ADD(IPS_SEEN_REPLY, seen_reply),
515 __ADD(IPS_ASSURED, assured),
516 __ADD(IPS_CONFIRMED, confirmed),
517 __ADD(IPS_SRC_NAT, snat),
518 __ADD(IPS_DST_NAT, dnat),
519 __ADD(IPS_SEQ_ADJUST, seqadjust),
520 __ADD(IPS_SRC_NAT_DONE, snat_done),
521 __ADD(IPS_DST_NAT_DONE, dnat_done),
522 __ADD(IPS_DYING, dying),
523 __ADD(IPS_FIXED_TIMEOUT, fixed_timeout),
524};
525
526char * nfnl_ct_status2str(int flags, char *buf, size_t len)
527{
528 return __flags2str(flags, buf, len, status_flags,
529 ARRAY_SIZE(status_flags));
530}
531
532int nfnl_ct_str2status(const char *name)
533{
534 return __str2flags(name, status_flags, ARRAY_SIZE(status_flags));
535}
536
537void nfnl_ct_set_timeout(struct nfnl_ct *ct, uint32_t timeout)
538{
539 ct->ct_timeout = timeout;
540 ct->ce_mask |= CT_ATTR_TIMEOUT;
541}
542
543int nfnl_ct_test_timeout(const struct nfnl_ct *ct)
544{
545 return !!(ct->ce_mask & CT_ATTR_TIMEOUT);
546}
547
548uint32_t nfnl_ct_get_timeout(const struct nfnl_ct *ct)
549{
550 return ct->ct_timeout;
551}
552
553void nfnl_ct_set_mark(struct nfnl_ct *ct, uint32_t mark)
554{
555 ct->ct_mark = mark;
556 ct->ce_mask |= CT_ATTR_MARK;
557}
558
559int nfnl_ct_test_mark(const struct nfnl_ct *ct)
560{
561 return !!(ct->ce_mask & CT_ATTR_MARK);
562}
563
564uint32_t nfnl_ct_get_mark(const struct nfnl_ct *ct)
565{
566 return ct->ct_mark;
567}
568
569void nfnl_ct_set_use(struct nfnl_ct *ct, uint32_t use)
570{
571 ct->ct_use = use;
572 ct->ce_mask |= CT_ATTR_USE;
573}
574
575int nfnl_ct_test_use(const struct nfnl_ct *ct)
576{
577 return !!(ct->ce_mask & CT_ATTR_USE);
578}
579
580uint32_t nfnl_ct_get_use(const struct nfnl_ct *ct)
581{
582 return ct->ct_use;
583}
584
585void nfnl_ct_set_id(struct nfnl_ct *ct, uint32_t id)
586{
587 ct->ct_id = id;
588 ct->ce_mask |= CT_ATTR_ID;
589}
590
591int nfnl_ct_test_id(const struct nfnl_ct *ct)
592{
593 return !!(ct->ce_mask & CT_ATTR_ID);
594}
595
596uint32_t nfnl_ct_get_id(const struct nfnl_ct *ct)
597{
598 return ct->ct_id;
599}
600
601void nfnl_ct_set_zone(struct nfnl_ct *ct, uint16_t zone)
602{
603 ct->ct_zone = zone;
604 ct->ce_mask |= CT_ATTR_ZONE;
605}
606
607int nfnl_ct_test_zone(const struct nfnl_ct *ct)
608{
609 return !!(ct->ce_mask & CT_ATTR_ZONE);
610}
611
612uint16_t nfnl_ct_get_zone(const struct nfnl_ct *ct)
613{
614 return ct->ct_zone;
615}
616
617static int ct_set_addr(struct nfnl_ct *ct, struct nl_addr *addr,
618 int attr, struct nl_addr ** ct_addr)
619{
620 if (ct->ce_mask & CT_ATTR_FAMILY) {
621 if (addr->a_family != ct->ct_family)
622 return -NLE_AF_MISMATCH;
623 } else
624 nfnl_ct_set_family(ct, addr->a_family);
625
626 if (*ct_addr)
627 nl_addr_put(*ct_addr);
628
629 nl_addr_get(addr);
630 *ct_addr = addr;
631 ct->ce_mask |= attr;
632
633 return 0;
634}
635
636int nfnl_ct_set_src(struct nfnl_ct *ct, int repl, struct nl_addr *addr)
637{
638 struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
639 int attr = repl ? CT_ATTR_REPL_SRC : CT_ATTR_ORIG_SRC;
640 return ct_set_addr(ct, addr, attr, &dir->src);
641}
642
643int nfnl_ct_set_dst(struct nfnl_ct *ct, int repl, struct nl_addr *addr)
644{
645 struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
646 int attr = repl ? CT_ATTR_REPL_DST : CT_ATTR_ORIG_DST;
647 return ct_set_addr(ct, addr, attr, &dir->dst);
648}
649
650struct nl_addr *nfnl_ct_get_src(const struct nfnl_ct *ct, int repl)
651{
652 const struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
653 int attr = repl ? CT_ATTR_REPL_SRC : CT_ATTR_ORIG_SRC;
654 if (!(ct->ce_mask & attr))
655 return NULL;
656 return dir->src;
657}
658
659struct nl_addr *nfnl_ct_get_dst(const struct nfnl_ct *ct, int repl)
660{
661 const struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
662 int attr = repl ? CT_ATTR_REPL_DST : CT_ATTR_ORIG_DST;
663 if (!(ct->ce_mask & attr))
664 return NULL;
665 return dir->dst;
666}
667
668void nfnl_ct_set_src_port(struct nfnl_ct *ct, int repl, uint16_t port)
669{
670 struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
671 int attr = repl ? CT_ATTR_REPL_SRC_PORT : CT_ATTR_ORIG_SRC_PORT;
672
673 dir->proto.port.src = port;
674 ct->ce_mask |= attr;
675}
676
677int nfnl_ct_test_src_port(const struct nfnl_ct *ct, int repl)
678{
679 int attr = repl ? CT_ATTR_REPL_SRC_PORT : CT_ATTR_ORIG_SRC_PORT;
680 return !!(ct->ce_mask & attr);
681}
682
683uint16_t nfnl_ct_get_src_port(const struct nfnl_ct *ct, int repl)
684{
685 const struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
686
687 return dir->proto.port.src;
688}
689
690void nfnl_ct_set_dst_port(struct nfnl_ct *ct, int repl, uint16_t port)
691{
692 struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
693 int attr = repl ? CT_ATTR_REPL_DST_PORT : CT_ATTR_ORIG_DST_PORT;
694
695 dir->proto.port.dst = port;
696 ct->ce_mask |= attr;
697}
698
699int nfnl_ct_test_dst_port(const struct nfnl_ct *ct, int repl)
700{
701 int attr = repl ? CT_ATTR_REPL_DST_PORT : CT_ATTR_ORIG_DST_PORT;
702 return !!(ct->ce_mask & attr);
703}
704
705uint16_t nfnl_ct_get_dst_port(const struct nfnl_ct *ct, int repl)
706{
707 const struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
708
709 return dir->proto.port.dst;
710}
711
712void nfnl_ct_set_icmp_id(struct nfnl_ct *ct, int repl, uint16_t id)
713{
714 struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
715 int attr = repl ? CT_ATTR_REPL_ICMP_ID : CT_ATTR_ORIG_ICMP_ID;
716
717 dir->proto.icmp.id = id;
718 ct->ce_mask |= attr;
719}
720
721int nfnl_ct_test_icmp_id(const struct nfnl_ct *ct, int repl)
722{
723 int attr = repl ? CT_ATTR_REPL_ICMP_ID : CT_ATTR_ORIG_ICMP_ID;
724 return !!(ct->ce_mask & attr);
725}
726
727uint16_t nfnl_ct_get_icmp_id(const struct nfnl_ct *ct, int repl)
728{
729 const struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
730
731 return dir->proto.icmp.id;
732}
733
734void nfnl_ct_set_icmp_type(struct nfnl_ct *ct, int repl, uint8_t type)
735{
736 struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
737 int attr = repl ? CT_ATTR_REPL_ICMP_TYPE : CT_ATTR_ORIG_ICMP_TYPE;
738
739 dir->proto.icmp.type = type;
740 ct->ce_mask |= attr;
741}
742
743int nfnl_ct_test_icmp_type(const struct nfnl_ct *ct, int repl)
744{
745 int attr = repl ? CT_ATTR_REPL_ICMP_TYPE : CT_ATTR_ORIG_ICMP_TYPE;
746 return !!(ct->ce_mask & attr);
747}
748
749uint8_t nfnl_ct_get_icmp_type(const struct nfnl_ct *ct, int repl)
750{
751 const struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
752
753 return dir->proto.icmp.type;
754}
755
756void nfnl_ct_set_icmp_code(struct nfnl_ct *ct, int repl, uint8_t code)
757{
758 struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
759 int attr = repl ? CT_ATTR_REPL_ICMP_CODE : CT_ATTR_ORIG_ICMP_CODE;
760
761 dir->proto.icmp.code = code;
762 ct->ce_mask |= attr;
763}
764
765int nfnl_ct_test_icmp_code(const struct nfnl_ct *ct, int repl)
766{
767 int attr = repl ? CT_ATTR_REPL_ICMP_CODE : CT_ATTR_ORIG_ICMP_CODE;
768 return !!(ct->ce_mask & attr);
769}
770
771uint8_t nfnl_ct_get_icmp_code(const struct nfnl_ct *ct, int repl)
772{
773 const struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
774
775 return dir->proto.icmp.code;
776}
777
778void nfnl_ct_set_packets(struct nfnl_ct *ct, int repl, uint64_t packets)
779{
780 struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
781 int attr = repl ? CT_ATTR_REPL_PACKETS : CT_ATTR_ORIG_PACKETS;
782
783 dir->packets = packets;
784 ct->ce_mask |= attr;
785}
786
787int nfnl_ct_test_packets(const struct nfnl_ct *ct, int repl)
788{
789 int attr = repl ? CT_ATTR_REPL_PACKETS : CT_ATTR_ORIG_PACKETS;
790 return !!(ct->ce_mask & attr);
791}
792
793uint64_t nfnl_ct_get_packets(const struct nfnl_ct *ct, int repl)
794{
795 const struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
796
797 return dir->packets;
798}
799
800void nfnl_ct_set_bytes(struct nfnl_ct *ct, int repl, uint64_t bytes)
801{
802 struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
803 int attr = repl ? CT_ATTR_REPL_BYTES : CT_ATTR_ORIG_BYTES;
804
805 dir->bytes = bytes;
806 ct->ce_mask |= attr;
807}
808
809int nfnl_ct_test_bytes(const struct nfnl_ct *ct, int repl)
810{
811 int attr = repl ? CT_ATTR_REPL_BYTES : CT_ATTR_ORIG_BYTES;
812 return !!(ct->ce_mask & attr);
813}
814
815uint64_t nfnl_ct_get_bytes(const struct nfnl_ct *ct, int repl)
816{
817 const struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
818
819 return dir->bytes;
820}
821
822void nfnl_ct_set_timestamp(struct nfnl_ct *ct, uint64_t start, uint64_t stop)
823{
824 ct->ct_tstamp.start = start;
825 ct->ct_tstamp.stop = stop;
826 ct->ce_mask |= CT_ATTR_TIMESTAMP;
827}
828
829int nfnl_ct_test_timestamp(const struct nfnl_ct *ct)
830{
831 return !!(ct->ce_mask & CT_ATTR_TIMESTAMP);
832}
833
834const struct nfnl_ct_timestamp *nfnl_ct_get_timestamp(const struct nfnl_ct *ct)
835{
836 return &ct->ct_tstamp;
837}
838
839/** @} */
840
841struct nl_object_ops ct_obj_ops = {
842 .oo_name = "netfilter/ct",
843 .oo_size = sizeof(struct nfnl_ct),
844 .oo_free_data = ct_free_data,
845 .oo_clone = ct_clone,
846 .oo_dump = {
847 [NL_DUMP_LINE] = ct_dump_line,
848 [NL_DUMP_DETAILS] = ct_dump_details,
849 [NL_DUMP_STATS] = ct_dump_stats,
850 },
851 .oo_compare = ct_compare,
852 .oo_attrs2str = ct_attrs2str,
853};
854
855/** @} */
struct nl_addr * nl_addr_get(struct nl_addr *addr)
Increase the reference counter of an abstract address.
Definition addr.c:525
int nl_addr_cmp(const struct nl_addr *a, const struct nl_addr *b)
Compare abstract addresses.
Definition addr.c:587
struct nl_addr * nl_addr_clone(const struct nl_addr *addr)
Clone existing abstract address object.
Definition addr.c:495
char * nl_addr2str(const struct nl_addr *addr, char *buf, size_t size)
Convert abstract address object to character string.
Definition addr.c:1001
void nl_addr_put(struct nl_addr *addr)
Decrease the reference counter of an abstract address.
Definition addr.c:541
void nl_object_put(struct nl_object *obj)
Release a reference from an object.
Definition object.c:221
void nl_object_get(struct nl_object *obj)
Acquire a reference on a object.
Definition object.c:210
struct nl_object * nl_object_alloc(struct nl_object_ops *ops)
Allocate a new object of kind specified by the operations handle.
Definition object.c:55
void nl_dump(struct nl_dump_params *params, const char *fmt,...)
Dump a formatted character string.
Definition utils.c:1015
double nl_cancel_down_bytes(unsigned long long l, char **unit)
Cancel down a byte counter.
Definition utils.c:223
void nl_new_line(struct nl_dump_params *params)
Handle a new line while dumping.
Definition utils.c:966
char * nl_msec2str(uint64_t msec, char *buf, size_t len)
Convert milliseconds to a character string.
Definition utils.c:648
@ NL_DUMP_STATS
Dump all attributes including statistics.
Definition types.h:22
@ NL_DUMP_LINE
Dump object briefly on one line.
Definition types.h:20
@ NL_DUMP_DETAILS
Dump all attributes but no statistics.
Definition types.h:21
Dumping parameters.
Definition types.h:32