libnl  3.2.21
ct_obj.c
1 /*
2  * lib/netfilter/ct_obj.c Conntrack Object
3  *
4  * This library is free software; you can redistribute it and/or
5  * modify it under the terms of the GNU Lesser General Public
6  * License as published by the Free Software Foundation version 2.1
7  * of the License.
8  *
9  * Copyright (c) 2003-2008 Thomas Graf <tgraf@suug.ch>
10  * Copyright (c) 2007 Philip Craig <philipc@snapgear.com>
11  * Copyright (c) 2007 Secure Computing Corporation
12  */
13 
14 #include <sys/types.h>
15 #include <linux/netfilter/nfnetlink_conntrack.h>
16 #include <linux/netfilter/nf_conntrack_common.h>
17 #include <linux/netfilter/nf_conntrack_tcp.h>
18 
19 #include <netlink-private/netlink.h>
20 #include <netlink/netfilter/nfnl.h>
21 #include <netlink/netfilter/ct.h>
22 
23 /** @cond SKIP */
24 #define CT_ATTR_FAMILY (1UL << 0)
25 #define CT_ATTR_PROTO (1UL << 1)
26 
27 #define CT_ATTR_TCP_STATE (1UL << 2)
28 
29 #define CT_ATTR_STATUS (1UL << 3)
30 #define CT_ATTR_TIMEOUT (1UL << 4)
31 #define CT_ATTR_MARK (1UL << 5)
32 #define CT_ATTR_USE (1UL << 6)
33 #define CT_ATTR_ID (1UL << 7)
34 
35 #define CT_ATTR_ORIG_SRC (1UL << 8)
36 #define CT_ATTR_ORIG_DST (1UL << 9)
37 #define CT_ATTR_ORIG_SRC_PORT (1UL << 10)
38 #define CT_ATTR_ORIG_DST_PORT (1UL << 11)
39 #define CT_ATTR_ORIG_ICMP_ID (1UL << 12)
40 #define CT_ATTR_ORIG_ICMP_TYPE (1UL << 13)
41 #define CT_ATTR_ORIG_ICMP_CODE (1UL << 14)
42 #define CT_ATTR_ORIG_PACKETS (1UL << 15)
43 #define CT_ATTR_ORIG_BYTES (1UL << 16)
44 
45 #define CT_ATTR_REPL_SRC (1UL << 17)
46 #define CT_ATTR_REPL_DST (1UL << 18)
47 #define CT_ATTR_REPL_SRC_PORT (1UL << 19)
48 #define CT_ATTR_REPL_DST_PORT (1UL << 20)
49 #define CT_ATTR_REPL_ICMP_ID (1UL << 21)
50 #define CT_ATTR_REPL_ICMP_TYPE (1UL << 22)
51 #define CT_ATTR_REPL_ICMP_CODE (1UL << 23)
52 #define CT_ATTR_REPL_PACKETS (1UL << 24)
53 #define CT_ATTR_REPL_BYTES (1UL << 25)
54 /** @endcond */
55 
56 static void ct_free_data(struct nl_object *c)
57 {
58  struct nfnl_ct *ct = (struct nfnl_ct *) c;
59 
60  if (ct == NULL)
61  return;
62 
63  nl_addr_put(ct->ct_orig.src);
64  nl_addr_put(ct->ct_orig.dst);
65  nl_addr_put(ct->ct_repl.src);
66  nl_addr_put(ct->ct_repl.dst);
67 }
68 
69 static int ct_clone(struct nl_object *_dst, struct nl_object *_src)
70 {
71  struct nfnl_ct *dst = (struct nfnl_ct *) _dst;
72  struct nfnl_ct *src = (struct nfnl_ct *) _src;
73  struct nl_addr *addr;
74 
75  if (src->ct_orig.src) {
76  addr = nl_addr_clone(src->ct_orig.src);
77  if (!addr)
78  return -NLE_NOMEM;
79  dst->ct_orig.src = addr;
80  }
81 
82  if (src->ct_orig.dst) {
83  addr = nl_addr_clone(src->ct_orig.dst);
84  if (!addr)
85  return -NLE_NOMEM;
86  dst->ct_orig.dst = addr;
87  }
88 
89  if (src->ct_repl.src) {
90  addr = nl_addr_clone(src->ct_repl.src);
91  if (!addr)
92  return -NLE_NOMEM;
93  dst->ct_repl.src = addr;
94  }
95 
96  if (src->ct_repl.dst) {
97  addr = nl_addr_clone(src->ct_repl.dst);
98  if (!addr)
99  return -NLE_NOMEM;
100  dst->ct_repl.dst = addr;
101  }
102 
103  return 0;
104 }
105 
106 static void dump_addr(struct nl_dump_params *p, struct nl_addr *addr, int port)
107 {
108  char buf[64];
109 
110  if (addr)
111  nl_dump(p, "%s", nl_addr2str(addr, buf, sizeof(buf)));
112 
113  if (port)
114  nl_dump(p, ":%u ", port);
115  else if (addr)
116  nl_dump(p, " ");
117 }
118 
119 static void dump_icmp(struct nl_dump_params *p, struct nfnl_ct *ct, int reply)
120 {
121  if (nfnl_ct_test_icmp_type(ct, reply))
122  nl_dump(p, "icmp type %d ", nfnl_ct_get_icmp_type(ct, reply));
123 
124  if (nfnl_ct_test_icmp_code(ct, reply))
125  nl_dump(p, "code %d ", nfnl_ct_get_icmp_code(ct, reply));
126 
127  if (nfnl_ct_test_icmp_id(ct, reply))
128  nl_dump(p, "id %d ", nfnl_ct_get_icmp_id(ct, reply));
129 }
130 
131 static void ct_dump_tuples(struct nfnl_ct *ct, struct nl_dump_params *p)
132 {
133  struct nl_addr *orig_src, *orig_dst, *reply_src, *reply_dst;
134  int orig_sport = 0, orig_dport = 0, reply_sport = 0, reply_dport = 0;
135  int sync = 0;
136 
137  orig_src = nfnl_ct_get_src(ct, 0);
138  orig_dst = nfnl_ct_get_dst(ct, 0);
139  reply_src = nfnl_ct_get_src(ct, 1);
140  reply_dst = nfnl_ct_get_dst(ct, 1);
141 
142  if (nfnl_ct_test_src_port(ct, 0))
143  orig_sport = nfnl_ct_get_src_port(ct, 0);
144 
145  if (nfnl_ct_test_dst_port(ct, 0))
146  orig_dport = nfnl_ct_get_dst_port(ct, 0);
147 
148  if (nfnl_ct_test_src_port(ct, 1))
149  reply_sport = nfnl_ct_get_src_port(ct, 1);
150 
151  if (nfnl_ct_test_dst_port(ct, 1))
152  reply_dport = nfnl_ct_get_dst_port(ct, 1);
153 
154  if (orig_src && orig_dst && reply_src && reply_dst &&
155  orig_sport == reply_dport && orig_dport == reply_sport &&
156  !nl_addr_cmp(orig_src, reply_dst) &&
157  !nl_addr_cmp(orig_dst, reply_src))
158  sync = 1;
159 
160  dump_addr(p, orig_src, orig_sport);
161  nl_dump(p, sync ? "<-> " : "-> ");
162  dump_addr(p, orig_dst, orig_dport);
163  dump_icmp(p, ct, 0);
164 
165  if (!sync) {
166  dump_addr(p, reply_src, reply_sport);
167  nl_dump(p, "<- ");
168  dump_addr(p, reply_dst, reply_dport);
169  dump_icmp(p, ct, 1);
170  }
171 }
172 
173 /* Compatible with /proc/net/nf_conntrack */
174 static void ct_dump_line(struct nl_object *a, struct nl_dump_params *p)
175 {
176  struct nfnl_ct *ct = (struct nfnl_ct *) a;
177  char buf[64];
178 
179  nl_new_line(p);
180 
181  if (nfnl_ct_test_proto(ct))
182  nl_dump(p, "%s ",
183  nl_ip_proto2str(nfnl_ct_get_proto(ct), buf, sizeof(buf)));
184 
185  if (nfnl_ct_test_tcp_state(ct))
186  nl_dump(p, "%s ",
187  nfnl_ct_tcp_state2str(nfnl_ct_get_tcp_state(ct),
188  buf, sizeof(buf)));
189 
190  ct_dump_tuples(ct, p);
191 
192  if (nfnl_ct_test_mark(ct) && nfnl_ct_get_mark(ct))
193  nl_dump(p, "mark %u ", nfnl_ct_get_mark(ct));
194 
195  nl_dump(p, "\n");
196 }
197 
198 static void ct_dump_details(struct nl_object *a, struct nl_dump_params *p)
199 {
200  struct nfnl_ct *ct = (struct nfnl_ct *) a;
201  char buf[64];
202  int fp = 0;
203 
204  ct_dump_line(a, p);
205 
206  nl_dump(p, " id 0x%x ", ct->ct_id);
207  nl_dump_line(p, "family %s ",
208  nl_af2str(ct->ct_family, buf, sizeof(buf)));
209 
210  if (nfnl_ct_test_use(ct))
211  nl_dump(p, "refcnt %u ", nfnl_ct_get_use(ct));
212 
213  if (nfnl_ct_test_timeout(ct)) {
214  uint64_t timeout_ms = nfnl_ct_get_timeout(ct) * 1000UL;
215  nl_dump(p, "timeout %s ",
216  nl_msec2str(timeout_ms, buf, sizeof(buf)));
217  }
218 
219  if (ct->ct_status)
220  nl_dump(p, "<");
221 
222 #define PRINT_FLAG(str) \
223  { nl_dump(p, "%s%s", fp++ ? "," : "", (str)); }
224 
225  if (ct->ct_status & IPS_EXPECTED)
226  PRINT_FLAG("EXPECTED");
227  if (!(ct->ct_status & IPS_SEEN_REPLY))
228  PRINT_FLAG("NOREPLY");
229  if (ct->ct_status & IPS_ASSURED)
230  PRINT_FLAG("ASSURED");
231  if (!(ct->ct_status & IPS_CONFIRMED))
232  PRINT_FLAG("NOTSENT");
233  if (ct->ct_status & IPS_SRC_NAT)
234  PRINT_FLAG("SNAT");
235  if (ct->ct_status & IPS_DST_NAT)
236  PRINT_FLAG("DNAT");
237  if (ct->ct_status & IPS_SEQ_ADJUST)
238  PRINT_FLAG("SEQADJUST");
239  if (!(ct->ct_status & IPS_SRC_NAT_DONE))
240  PRINT_FLAG("SNAT_INIT");
241  if (!(ct->ct_status & IPS_DST_NAT_DONE))
242  PRINT_FLAG("DNAT_INIT");
243  if (ct->ct_status & IPS_DYING)
244  PRINT_FLAG("DYING");
245  if (ct->ct_status & IPS_FIXED_TIMEOUT)
246  PRINT_FLAG("FIXED_TIMEOUT");
247 #undef PRINT_FLAG
248 
249  if (ct->ct_status)
250  nl_dump(p, ">");
251  nl_dump(p, "\n");
252 }
253 
254 static void ct_dump_stats(struct nl_object *a, struct nl_dump_params *p)
255 {
256  struct nfnl_ct *ct = (struct nfnl_ct *) a;
257  double res;
258  char *unit;
259  uint64_t packets;
260  const char * const names[] = {"rx", "tx"};
261  int i;
262 
263  ct_dump_details(a, p);
264 
265  if (!nfnl_ct_test_bytes(ct, 0) ||
266  !nfnl_ct_test_packets(ct, 0) ||
267  !nfnl_ct_test_bytes(ct, 1) ||
268  !nfnl_ct_test_packets(ct, 1))
269  {
270  nl_dump_line(p, " Statistics are not available.\n");
271  nl_dump_line(p, " Please set sysctl net.netfilter.nf_conntrack_acct=1\n");
272  nl_dump_line(p, " (Require kernel 2.6.27)\n");
273  return;
274  }
275 
276  nl_dump_line(p, " # packets volume\n");
277  for (i=0; i<=1; i++) {
278  res = nl_cancel_down_bytes(nfnl_ct_get_bytes(ct, i), &unit);
279  packets = nfnl_ct_get_packets(ct, i);
280  nl_dump_line(p, " %s %10" PRIu64 " %7.2f %s\n", names[i], packets, res, unit);
281  }
282 }
283 
284 static int ct_compare(struct nl_object *_a, struct nl_object *_b,
285  uint32_t attrs, int flags)
286 {
287  struct nfnl_ct *a = (struct nfnl_ct *) _a;
288  struct nfnl_ct *b = (struct nfnl_ct *) _b;
289  int diff = 0;
290 
291 #define CT_DIFF(ATTR, EXPR) ATTR_DIFF(attrs, CT_ATTR_##ATTR, a, b, EXPR)
292 #define CT_DIFF_VAL(ATTR, FIELD) CT_DIFF(ATTR, a->FIELD != b->FIELD)
293 #define CT_DIFF_ADDR(ATTR, FIELD) \
294  ((flags & LOOSE_COMPARISON) \
295  ? CT_DIFF(ATTR, nl_addr_cmp_prefix(a->FIELD, b->FIELD)) \
296  : CT_DIFF(ATTR, nl_addr_cmp(a->FIELD, b->FIELD)))
297 
298  diff |= CT_DIFF_VAL(FAMILY, ct_family);
299  diff |= CT_DIFF_VAL(PROTO, ct_proto);
300  diff |= CT_DIFF_VAL(TCP_STATE, ct_protoinfo.tcp.state);
301  diff |= CT_DIFF_VAL(TIMEOUT, ct_timeout);
302  diff |= CT_DIFF_VAL(MARK, ct_mark);
303  diff |= CT_DIFF_VAL(USE, ct_use);
304  diff |= CT_DIFF_VAL(ID, ct_id);
305  diff |= CT_DIFF_ADDR(ORIG_SRC, ct_orig.src);
306  diff |= CT_DIFF_ADDR(ORIG_DST, ct_orig.dst);
307  diff |= CT_DIFF_VAL(ORIG_SRC_PORT, ct_orig.proto.port.src);
308  diff |= CT_DIFF_VAL(ORIG_DST_PORT, ct_orig.proto.port.dst);
309  diff |= CT_DIFF_VAL(ORIG_ICMP_ID, ct_orig.proto.icmp.id);
310  diff |= CT_DIFF_VAL(ORIG_ICMP_TYPE, ct_orig.proto.icmp.type);
311  diff |= CT_DIFF_VAL(ORIG_ICMP_CODE, ct_orig.proto.icmp.code);
312  diff |= CT_DIFF_VAL(ORIG_PACKETS, ct_orig.packets);
313  diff |= CT_DIFF_VAL(ORIG_BYTES, ct_orig.bytes);
314  diff |= CT_DIFF_ADDR(REPL_SRC, ct_repl.src);
315  diff |= CT_DIFF_ADDR(REPL_DST, ct_repl.dst);
316  diff |= CT_DIFF_VAL(REPL_SRC_PORT, ct_repl.proto.port.src);
317  diff |= CT_DIFF_VAL(REPL_DST_PORT, ct_repl.proto.port.dst);
318  diff |= CT_DIFF_VAL(REPL_ICMP_ID, ct_repl.proto.icmp.id);
319  diff |= CT_DIFF_VAL(REPL_ICMP_TYPE, ct_repl.proto.icmp.type);
320  diff |= CT_DIFF_VAL(REPL_ICMP_CODE, ct_repl.proto.icmp.code);
321  diff |= CT_DIFF_VAL(REPL_PACKETS, ct_repl.packets);
322  diff |= CT_DIFF_VAL(REPL_BYTES, ct_repl.bytes);
323 
324  if (flags & LOOSE_COMPARISON)
325  diff |= CT_DIFF(STATUS, (a->ct_status ^ b->ct_status) &
326  b->ct_status_mask);
327  else
328  diff |= CT_DIFF(STATUS, a->ct_status != b->ct_status);
329 
330 #undef CT_DIFF
331 #undef CT_DIFF_VAL
332 #undef CT_DIFF_ADDR
333 
334  return diff;
335 }
336 
337 static const struct trans_tbl ct_attrs[] = {
338  __ADD(CT_ATTR_FAMILY, family)
339  __ADD(CT_ATTR_PROTO, proto)
340  __ADD(CT_ATTR_TCP_STATE, tcpstate)
341  __ADD(CT_ATTR_STATUS, status)
342  __ADD(CT_ATTR_TIMEOUT, timeout)
343  __ADD(CT_ATTR_MARK, mark)
344  __ADD(CT_ATTR_USE, use)
345  __ADD(CT_ATTR_ID, id)
346  __ADD(CT_ATTR_ORIG_SRC, origsrc)
347  __ADD(CT_ATTR_ORIG_DST, origdst)
348  __ADD(CT_ATTR_ORIG_SRC_PORT, origsrcport)
349  __ADD(CT_ATTR_ORIG_DST_PORT, origdstport)
350  __ADD(CT_ATTR_ORIG_ICMP_ID, origicmpid)
351  __ADD(CT_ATTR_ORIG_ICMP_TYPE, origicmptype)
352  __ADD(CT_ATTR_ORIG_ICMP_CODE, origicmpcode)
353  __ADD(CT_ATTR_ORIG_PACKETS, origpackets)
354  __ADD(CT_ATTR_ORIG_BYTES, origbytes)
355  __ADD(CT_ATTR_REPL_SRC, replysrc)
356  __ADD(CT_ATTR_REPL_DST, replydst)
357  __ADD(CT_ATTR_REPL_SRC_PORT, replysrcport)
358  __ADD(CT_ATTR_REPL_DST_PORT, replydstport)
359  __ADD(CT_ATTR_REPL_ICMP_ID, replyicmpid)
360  __ADD(CT_ATTR_REPL_ICMP_TYPE, replyicmptype)
361  __ADD(CT_ATTR_REPL_ICMP_CODE, replyicmpcode)
362  __ADD(CT_ATTR_REPL_PACKETS, replypackets)
363  __ADD(CT_ATTR_REPL_BYTES, replybytes)
364 };
365 
366 static char *ct_attrs2str(int attrs, char *buf, size_t len)
367 {
368  return __flags2str(attrs, buf, len, ct_attrs, ARRAY_SIZE(ct_attrs));
369 }
370 
371 /**
372  * @name Allocation/Freeing
373  * @{
374  */
375 
376 struct nfnl_ct *nfnl_ct_alloc(void)
377 {
378  return (struct nfnl_ct *) nl_object_alloc(&ct_obj_ops);
379 }
380 
381 void nfnl_ct_get(struct nfnl_ct *ct)
382 {
383  nl_object_get((struct nl_object *) ct);
384 }
385 
386 void nfnl_ct_put(struct nfnl_ct *ct)
387 {
388  nl_object_put((struct nl_object *) ct);
389 }
390 
391 /** @} */
392 
393 /**
394  * @name Attributes
395  * @{
396  */
397 
398 void nfnl_ct_set_family(struct nfnl_ct *ct, uint8_t family)
399 {
400  ct->ct_family = family;
401  ct->ce_mask |= CT_ATTR_FAMILY;
402 }
403 
404 uint8_t nfnl_ct_get_family(const struct nfnl_ct *ct)
405 {
406  if (ct->ce_mask & CT_ATTR_FAMILY)
407  return ct->ct_family;
408  else
409  return AF_UNSPEC;
410 }
411 
412 void nfnl_ct_set_proto(struct nfnl_ct *ct, uint8_t proto)
413 {
414  ct->ct_proto = proto;
415  ct->ce_mask |= CT_ATTR_PROTO;
416 }
417 
418 int nfnl_ct_test_proto(const struct nfnl_ct *ct)
419 {
420  return !!(ct->ce_mask & CT_ATTR_PROTO);
421 }
422 
423 uint8_t nfnl_ct_get_proto(const struct nfnl_ct *ct)
424 {
425  return ct->ct_proto;
426 }
427 
428 void nfnl_ct_set_tcp_state(struct nfnl_ct *ct, uint8_t state)
429 {
430  ct->ct_protoinfo.tcp.state = state;
431  ct->ce_mask |= CT_ATTR_TCP_STATE;
432 }
433 
434 int nfnl_ct_test_tcp_state(const struct nfnl_ct *ct)
435 {
436  return !!(ct->ce_mask & CT_ATTR_TCP_STATE);
437 }
438 
439 uint8_t nfnl_ct_get_tcp_state(const struct nfnl_ct *ct)
440 {
441  return ct->ct_protoinfo.tcp.state;
442 }
443 
444 static const struct trans_tbl tcp_states[] = {
445  __ADD(TCP_CONNTRACK_NONE,NONE)
446  __ADD(TCP_CONNTRACK_SYN_SENT,SYN_SENT)
447  __ADD(TCP_CONNTRACK_SYN_RECV,SYN_RECV)
448  __ADD(TCP_CONNTRACK_ESTABLISHED,ESTABLISHED)
449  __ADD(TCP_CONNTRACK_FIN_WAIT,FIN_WAIT)
450  __ADD(TCP_CONNTRACK_CLOSE_WAIT,CLOSE_WAIT)
451  __ADD(TCP_CONNTRACK_LAST_ACK,LAST_ACK)
452  __ADD(TCP_CONNTRACK_TIME_WAIT,TIME_WAIT)
453  __ADD(TCP_CONNTRACK_CLOSE,CLOSE)
454  __ADD(TCP_CONNTRACK_LISTEN,LISTEN)
455 };
456 
457 char *nfnl_ct_tcp_state2str(uint8_t state, char *buf, size_t len)
458 {
459  return __type2str(state, buf, len, tcp_states, ARRAY_SIZE(tcp_states));
460 }
461 
462 int nfnl_ct_str2tcp_state(const char *name)
463 {
464  return __str2type(name, tcp_states, ARRAY_SIZE(tcp_states));
465 }
466 
467 void nfnl_ct_set_status(struct nfnl_ct *ct, uint32_t status)
468 {
469  ct->ct_status_mask |= status;
470  ct->ct_status |= status;
471  ct->ce_mask |= CT_ATTR_STATUS;
472 }
473 
474 void nfnl_ct_unset_status(struct nfnl_ct *ct, uint32_t status)
475 {
476  ct->ct_status_mask |= status;
477  ct->ct_status &= ~status;
478  ct->ce_mask |= CT_ATTR_STATUS;
479 }
480 
481 uint32_t nfnl_ct_get_status(const struct nfnl_ct *ct)
482 {
483  return ct->ct_status;
484 }
485 
486 static const struct trans_tbl status_flags[] = {
487  __ADD(IPS_EXPECTED, expected)
488  __ADD(IPS_SEEN_REPLY, seen_reply)
489  __ADD(IPS_ASSURED, assured)
490  __ADD(IPS_CONFIRMED, confirmed)
491  __ADD(IPS_SRC_NAT, snat)
492  __ADD(IPS_DST_NAT, dnat)
493  __ADD(IPS_SEQ_ADJUST, seqadjust)
494  __ADD(IPS_SRC_NAT_DONE, snat_done)
495  __ADD(IPS_DST_NAT_DONE, dnat_done)
496  __ADD(IPS_DYING, dying)
497  __ADD(IPS_FIXED_TIMEOUT, fixed_timeout)
498 };
499 
500 char * nfnl_ct_status2str(int flags, char *buf, size_t len)
501 {
502  return __flags2str(flags, buf, len, status_flags,
503  ARRAY_SIZE(status_flags));
504 }
505 
506 int nfnl_ct_str2status(const char *name)
507 {
508  return __str2flags(name, status_flags, ARRAY_SIZE(status_flags));
509 }
510 
511 void nfnl_ct_set_timeout(struct nfnl_ct *ct, uint32_t timeout)
512 {
513  ct->ct_timeout = timeout;
514  ct->ce_mask |= CT_ATTR_TIMEOUT;
515 }
516 
517 int nfnl_ct_test_timeout(const struct nfnl_ct *ct)
518 {
519  return !!(ct->ce_mask & CT_ATTR_TIMEOUT);
520 }
521 
522 uint32_t nfnl_ct_get_timeout(const struct nfnl_ct *ct)
523 {
524  return ct->ct_timeout;
525 }
526 
527 void nfnl_ct_set_mark(struct nfnl_ct *ct, uint32_t mark)
528 {
529  ct->ct_mark = mark;
530  ct->ce_mask |= CT_ATTR_MARK;
531 }
532 
533 int nfnl_ct_test_mark(const struct nfnl_ct *ct)
534 {
535  return !!(ct->ce_mask & CT_ATTR_MARK);
536 }
537 
538 uint32_t nfnl_ct_get_mark(const struct nfnl_ct *ct)
539 {
540  return ct->ct_mark;
541 }
542 
543 void nfnl_ct_set_use(struct nfnl_ct *ct, uint32_t use)
544 {
545  ct->ct_use = use;
546  ct->ce_mask |= CT_ATTR_USE;
547 }
548 
549 int nfnl_ct_test_use(const struct nfnl_ct *ct)
550 {
551  return !!(ct->ce_mask & CT_ATTR_USE);
552 }
553 
554 uint32_t nfnl_ct_get_use(const struct nfnl_ct *ct)
555 {
556  return ct->ct_use;
557 }
558 
559 void nfnl_ct_set_id(struct nfnl_ct *ct, uint32_t id)
560 {
561  ct->ct_id = id;
562  ct->ce_mask |= CT_ATTR_ID;
563 }
564 
565 int nfnl_ct_test_id(const struct nfnl_ct *ct)
566 {
567  return !!(ct->ce_mask & CT_ATTR_ID);
568 }
569 
570 uint32_t nfnl_ct_get_id(const struct nfnl_ct *ct)
571 {
572  return ct->ct_id;
573 }
574 
575 static int ct_set_addr(struct nfnl_ct *ct, struct nl_addr *addr,
576  int attr, struct nl_addr ** ct_addr)
577 {
578  if (ct->ce_mask & CT_ATTR_FAMILY) {
579  if (addr->a_family != ct->ct_family)
580  return -NLE_AF_MISMATCH;
581  } else
582  nfnl_ct_set_family(ct, addr->a_family);
583 
584  if (*ct_addr)
585  nl_addr_put(*ct_addr);
586 
587  nl_addr_get(addr);
588  *ct_addr = addr;
589  ct->ce_mask |= attr;
590 
591  return 0;
592 }
593 
594 int nfnl_ct_set_src(struct nfnl_ct *ct, int repl, struct nl_addr *addr)
595 {
596  struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
597  int attr = repl ? CT_ATTR_REPL_SRC : CT_ATTR_ORIG_SRC;
598  return ct_set_addr(ct, addr, attr, &dir->src);
599 }
600 
601 int nfnl_ct_set_dst(struct nfnl_ct *ct, int repl, struct nl_addr *addr)
602 {
603  struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
604  int attr = repl ? CT_ATTR_REPL_DST : CT_ATTR_ORIG_DST;
605  return ct_set_addr(ct, addr, attr, &dir->dst);
606 }
607 
608 struct nl_addr *nfnl_ct_get_src(const struct nfnl_ct *ct, int repl)
609 {
610  const struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
611  int attr = repl ? CT_ATTR_REPL_SRC : CT_ATTR_ORIG_SRC;
612  if (!(ct->ce_mask & attr))
613  return NULL;
614  return dir->src;
615 }
616 
617 struct nl_addr *nfnl_ct_get_dst(const struct nfnl_ct *ct, int repl)
618 {
619  const struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
620  int attr = repl ? CT_ATTR_REPL_DST : CT_ATTR_ORIG_DST;
621  if (!(ct->ce_mask & attr))
622  return NULL;
623  return dir->dst;
624 }
625 
626 void nfnl_ct_set_src_port(struct nfnl_ct *ct, int repl, uint16_t port)
627 {
628  struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
629  int attr = repl ? CT_ATTR_REPL_SRC_PORT : CT_ATTR_ORIG_SRC_PORT;
630 
631  dir->proto.port.src = port;
632  ct->ce_mask |= attr;
633 }
634 
635 int nfnl_ct_test_src_port(const struct nfnl_ct *ct, int repl)
636 {
637  int attr = repl ? CT_ATTR_REPL_SRC_PORT : CT_ATTR_ORIG_SRC_PORT;
638  return !!(ct->ce_mask & attr);
639 }
640 
641 uint16_t nfnl_ct_get_src_port(const struct nfnl_ct *ct, int repl)
642 {
643  const struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
644 
645  return dir->proto.port.src;
646 }
647 
648 void nfnl_ct_set_dst_port(struct nfnl_ct *ct, int repl, uint16_t port)
649 {
650  struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
651  int attr = repl ? CT_ATTR_REPL_DST_PORT : CT_ATTR_ORIG_DST_PORT;
652 
653  dir->proto.port.dst = port;
654  ct->ce_mask |= attr;
655 }
656 
657 int nfnl_ct_test_dst_port(const struct nfnl_ct *ct, int repl)
658 {
659  int attr = repl ? CT_ATTR_REPL_DST_PORT : CT_ATTR_ORIG_DST_PORT;
660  return !!(ct->ce_mask & attr);
661 }
662 
663 uint16_t nfnl_ct_get_dst_port(const struct nfnl_ct *ct, int repl)
664 {
665  const struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
666 
667  return dir->proto.port.dst;
668 }
669 
670 void nfnl_ct_set_icmp_id(struct nfnl_ct *ct, int repl, uint16_t id)
671 {
672  struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
673  int attr = repl ? CT_ATTR_REPL_ICMP_ID : CT_ATTR_ORIG_ICMP_ID;
674 
675  dir->proto.icmp.id = id;
676  ct->ce_mask |= attr;
677 }
678 
679 int nfnl_ct_test_icmp_id(const struct nfnl_ct *ct, int repl)
680 {
681  int attr = repl ? CT_ATTR_REPL_ICMP_ID : CT_ATTR_ORIG_ICMP_ID;
682  return !!(ct->ce_mask & attr);
683 }
684 
685 uint16_t nfnl_ct_get_icmp_id(const struct nfnl_ct *ct, int repl)
686 {
687  const struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
688 
689  return dir->proto.icmp.id;
690 }
691 
692 void nfnl_ct_set_icmp_type(struct nfnl_ct *ct, int repl, uint8_t type)
693 {
694  struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
695  int attr = repl ? CT_ATTR_REPL_ICMP_TYPE : CT_ATTR_ORIG_ICMP_TYPE;
696 
697  dir->proto.icmp.type = type;
698  ct->ce_mask |= attr;
699 }
700 
701 int nfnl_ct_test_icmp_type(const struct nfnl_ct *ct, int repl)
702 {
703  int attr = repl ? CT_ATTR_REPL_ICMP_TYPE : CT_ATTR_ORIG_ICMP_TYPE;
704  return !!(ct->ce_mask & attr);
705 }
706 
707 uint8_t nfnl_ct_get_icmp_type(const struct nfnl_ct *ct, int repl)
708 {
709  const struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
710 
711  return dir->proto.icmp.type;
712 }
713 
714 void nfnl_ct_set_icmp_code(struct nfnl_ct *ct, int repl, uint8_t code)
715 {
716  struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
717  int attr = repl ? CT_ATTR_REPL_ICMP_CODE : CT_ATTR_ORIG_ICMP_CODE;
718 
719  dir->proto.icmp.code = code;
720  ct->ce_mask |= attr;
721 }
722 
723 int nfnl_ct_test_icmp_code(const struct nfnl_ct *ct, int repl)
724 {
725  int attr = repl ? CT_ATTR_REPL_ICMP_CODE : CT_ATTR_ORIG_ICMP_CODE;
726  return !!(ct->ce_mask & attr);
727 }
728 
729 uint8_t nfnl_ct_get_icmp_code(const struct nfnl_ct *ct, int repl)
730 {
731  const struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
732 
733  return dir->proto.icmp.code;
734 }
735 
736 void nfnl_ct_set_packets(struct nfnl_ct *ct, int repl, uint64_t packets)
737 {
738  struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
739  int attr = repl ? CT_ATTR_REPL_PACKETS : CT_ATTR_ORIG_PACKETS;
740 
741  dir->packets = packets;
742  ct->ce_mask |= attr;
743 }
744 
745 int nfnl_ct_test_packets(const struct nfnl_ct *ct, int repl)
746 {
747  int attr = repl ? CT_ATTR_REPL_PACKETS : CT_ATTR_ORIG_PACKETS;
748  return !!(ct->ce_mask & attr);
749 }
750 
751 uint64_t nfnl_ct_get_packets(const struct nfnl_ct *ct, int repl)
752 {
753  const struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
754 
755  return dir->packets;
756 }
757 
758 void nfnl_ct_set_bytes(struct nfnl_ct *ct, int repl, uint64_t bytes)
759 {
760  struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
761  int attr = repl ? CT_ATTR_REPL_BYTES : CT_ATTR_ORIG_BYTES;
762 
763  dir->bytes = bytes;
764  ct->ce_mask |= attr;
765 }
766 
767 int nfnl_ct_test_bytes(const struct nfnl_ct *ct, int repl)
768 {
769  int attr = repl ? CT_ATTR_REPL_BYTES : CT_ATTR_ORIG_BYTES;
770  return !!(ct->ce_mask & attr);
771 }
772 
773 uint64_t nfnl_ct_get_bytes(const struct nfnl_ct *ct, int repl)
774 {
775  const struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
776 
777  return dir->bytes;
778 }
779 
780 /** @} */
781 
782 struct nl_object_ops ct_obj_ops = {
783  .oo_name = "netfilter/ct",
784  .oo_size = sizeof(struct nfnl_ct),
785  .oo_free_data = ct_free_data,
786  .oo_clone = ct_clone,
787  .oo_dump = {
788  [NL_DUMP_LINE] = ct_dump_line,
789  [NL_DUMP_DETAILS] = ct_dump_details,
790  [NL_DUMP_STATS] = ct_dump_stats,
791  },
792  .oo_compare = ct_compare,
793  .oo_attrs2str = ct_attrs2str,
794 };
795 
796 /** @} */