12#include "internal/internal.h"
14#include <libmnl/libmnl.h>
17nfct_build_tuple_ip(
struct nlmsghdr *nlh,
const struct __nfct_tuple *t)
21 nest = mnl_attr_nest_start(nlh, CTA_TUPLE_IP);
25 switch(t->l3protonum) {
27 mnl_attr_put_u32(nlh, CTA_IP_V4_SRC, t->src.v4);
28 mnl_attr_put_u32(nlh, CTA_IP_V4_DST, t->dst.v4);
31 mnl_attr_put(nlh, CTA_IP_V6_SRC,
sizeof(
struct in6_addr),
33 mnl_attr_put(nlh, CTA_IP_V6_DST,
sizeof(
struct in6_addr),
37 mnl_attr_nest_cancel(nlh, nest);
40 mnl_attr_nest_end(nlh, nest);
45nfct_build_tuple_proto(
struct nlmsghdr *nlh,
const struct __nfct_tuple *t)
49 nest = mnl_attr_nest_start(nlh, CTA_TUPLE_PROTO);
53 mnl_attr_put_u8(nlh, CTA_PROTO_NUM, t->protonum);
62 mnl_attr_put_u16(nlh, CTA_PROTO_SRC_PORT, t->l4src.tcp.port);
63 mnl_attr_put_u16(nlh, CTA_PROTO_DST_PORT, t->l4dst.tcp.port);
66 mnl_attr_put_u8(nlh, CTA_PROTO_ICMP_CODE, t->l4dst.icmp.code);
67 mnl_attr_put_u8(nlh, CTA_PROTO_ICMP_TYPE, t->l4dst.icmp.type);
68 mnl_attr_put_u16(nlh, CTA_PROTO_ICMP_ID, t->l4src.icmp.id);
71 mnl_attr_put_u8(nlh, CTA_PROTO_ICMPV6_CODE, t->l4dst.icmp.code);
72 mnl_attr_put_u8(nlh, CTA_PROTO_ICMPV6_TYPE, t->l4dst.icmp.type);
73 mnl_attr_put_u16(nlh, CTA_PROTO_ICMPV6_ID, t->l4src.icmp.id);
78 mnl_attr_nest_end(nlh, nest);
83nfct_build_tuple_raw(
struct nlmsghdr *nlh,
const struct __nfct_tuple *t)
85 if (nfct_build_tuple_ip(nlh, t) < 0)
87 if (nfct_build_tuple_proto(nlh, t) < 0)
94nfct_build_tuple(
struct nlmsghdr *nlh,
const struct __nfct_tuple *t,
int type)
98 nest = mnl_attr_nest_start(nlh, type);
102 if (nfct_build_tuple_raw(nlh, t) < 0)
105 mnl_attr_nest_end(nlh, nest);
108 mnl_attr_nest_cancel(nlh, nest);
113nfct_build_protoinfo(
struct nlmsghdr *nlh,
const struct nf_conntrack *ct)
115 struct nlattr *nest, *nest_proto;
117 switch(ct->head.orig.protonum) {
122 if (!(test_bit(ATTR_TCP_STATE, ct->head.set) ||
123 test_bit(ATTR_TCP_FLAGS_ORIG, ct->head.set) ||
124 test_bit(ATTR_TCP_FLAGS_REPL, ct->head.set) ||
125 test_bit(ATTR_TCP_MASK_ORIG, ct->head.set) ||
126 test_bit(ATTR_TCP_MASK_REPL, ct->head.set) ||
127 test_bit(ATTR_TCP_WSCALE_ORIG, ct->head.set) ||
128 test_bit(ATTR_TCP_WSCALE_REPL, ct->head.set))) {
131 nest = mnl_attr_nest_start(nlh, CTA_PROTOINFO);
132 nest_proto = mnl_attr_nest_start(nlh, CTA_PROTOINFO_TCP);
133 if (test_bit(ATTR_TCP_STATE, ct->head.set)) {
134 mnl_attr_put_u8(nlh, CTA_PROTOINFO_TCP_STATE,
135 ct->protoinfo.tcp.state);
137 if (test_bit(ATTR_TCP_FLAGS_ORIG, ct->head.set) &&
138 test_bit(ATTR_TCP_MASK_ORIG, ct->head.set)) {
139 mnl_attr_put(nlh, CTA_PROTOINFO_TCP_FLAGS_ORIGINAL,
140 sizeof(
struct nf_ct_tcp_flags),
141 &ct->protoinfo.tcp.flags[0]);
143 if (test_bit(ATTR_TCP_FLAGS_REPL, ct->head.set) &&
144 test_bit(ATTR_TCP_MASK_REPL, ct->head.set)) {
145 mnl_attr_put(nlh, CTA_PROTOINFO_TCP_FLAGS_REPLY,
146 sizeof(
struct nf_ct_tcp_flags),
147 &ct->protoinfo.tcp.flags[1]);
149 if (test_bit(ATTR_TCP_WSCALE_ORIG, ct->head.set)) {
150 mnl_attr_put_u8(nlh, CTA_PROTOINFO_TCP_WSCALE_ORIGINAL,
151 ct->protoinfo.tcp.wscale[__DIR_ORIG]);
153 if (test_bit(ATTR_TCP_WSCALE_REPL, ct->head.set)) {
154 mnl_attr_put_u8(nlh, CTA_PROTOINFO_TCP_WSCALE_REPLY,
155 ct->protoinfo.tcp.wscale[__DIR_REPL]);
157 mnl_attr_nest_end(nlh, nest_proto);
158 mnl_attr_nest_end(nlh, nest);
162 if (!(test_bit(ATTR_SCTP_STATE, ct->head.set) ||
163 test_bit(ATTR_SCTP_VTAG_ORIG, ct->head.set) ||
164 test_bit(ATTR_SCTP_VTAG_REPL, ct->head.set))) {
167 nest = mnl_attr_nest_start(nlh, CTA_PROTOINFO);
168 nest_proto = mnl_attr_nest_start(nlh, CTA_PROTOINFO_SCTP);
170 if (test_bit(ATTR_SCTP_STATE, ct->head.set)) {
171 mnl_attr_put_u8(nlh, CTA_PROTOINFO_SCTP_STATE,
172 ct->protoinfo.sctp.state);
174 if (test_bit(ATTR_SCTP_VTAG_ORIG, ct->head.set)) {
175 mnl_attr_put_u32(nlh, CTA_PROTOINFO_SCTP_VTAG_ORIGINAL,
176 htonl(ct->protoinfo.sctp.vtag[__DIR_ORIG]));
178 if (test_bit(ATTR_SCTP_VTAG_REPL, ct->head.set)) {
179 mnl_attr_put_u32(nlh, CTA_PROTOINFO_SCTP_VTAG_REPLY,
180 htonl(ct->protoinfo.sctp.vtag[__DIR_REPL]));
182 mnl_attr_nest_end(nlh, nest_proto);
183 mnl_attr_nest_end(nlh, nest);
187 if (!(test_bit(ATTR_DCCP_STATE, ct->head.set) ||
188 test_bit(ATTR_DCCP_ROLE, ct->head.set) ||
189 test_bit(ATTR_DCCP_HANDSHAKE_SEQ, ct->head.set))) {
192 nest = mnl_attr_nest_start(nlh, CTA_PROTOINFO);
193 nest_proto = mnl_attr_nest_start(nlh, CTA_PROTOINFO_DCCP);
194 if (test_bit(ATTR_DCCP_STATE, ct->head.set)) {
195 mnl_attr_put_u8(nlh, CTA_PROTOINFO_DCCP_STATE,
196 ct->protoinfo.dccp.state);
198 if (test_bit(ATTR_DCCP_ROLE, ct->head.set)) {
199 mnl_attr_put_u8(nlh, CTA_PROTOINFO_DCCP_ROLE,
200 ct->protoinfo.dccp.role);
202 if (test_bit(ATTR_DCCP_HANDSHAKE_SEQ, ct->head.set)) {
203 uint64_t handshake_seq =
204 be64toh(ct->protoinfo.dccp.handshake_seq);
206 mnl_attr_put_u64(nlh, CTA_PROTOINFO_DCCP_HANDSHAKE_SEQ,
209 mnl_attr_nest_end(nlh, nest_proto);
210 mnl_attr_nest_end(nlh, nest);
218nfct_nat_seq_adj(
struct nlmsghdr *nlh,
const struct nf_conntrack *ct,
int dir)
220 mnl_attr_put_u32(nlh, CTA_NAT_SEQ_CORRECTION_POS,
221 htonl(ct->natseq[dir].correction_pos));
222 mnl_attr_put_u32(nlh, CTA_NAT_SEQ_OFFSET_BEFORE,
223 htonl(ct->natseq[dir].offset_before));
224 mnl_attr_put_u32(nlh, CTA_NAT_SEQ_OFFSET_AFTER,
225 htonl(ct->natseq[dir].offset_after));
230nfct_build_nat_seq_adj(
struct nlmsghdr *nlh,
const struct nf_conntrack *ct,
233 int type = (dir == __DIR_ORIG) ? CTA_NAT_SEQ_ADJ_ORIG :
234 CTA_NAT_SEQ_ADJ_REPLY;
237 nest = mnl_attr_nest_start(nlh, type);
238 nfct_nat_seq_adj(nlh, ct, dir);
239 mnl_attr_nest_end(nlh, nest);
245nfct_build_protonat(
struct nlmsghdr *nlh,
const struct nf_conntrack *ct,
246 const struct __nfct_nat *nat)
250 nest = mnl_attr_nest_start(nlh, CTA_NAT_PROTO);
252 switch (ct->head.orig.protonum) {
255 mnl_attr_put_u16(nlh, CTA_PROTONAT_PORT_MIN,
256 nat->l4min.tcp.port);
257 mnl_attr_put_u16(nlh, CTA_PROTONAT_PORT_MAX,
258 nat->l4max.tcp.port);
261 mnl_attr_nest_end(nlh, nest);
266nfct_build_nat(
struct nlmsghdr *nlh,
const struct __nfct_nat *nat,
269 switch (l3protonum) {
271 mnl_attr_put_u32(nlh, CTA_NAT_MINIP, nat->min_ip.v4);
274 mnl_attr_put(nlh, CTA_NAT_V6_MINIP,
sizeof(
struct in6_addr),
284nfct_build_snat(
struct nlmsghdr *nlh,
const struct nf_conntrack *ct,
289 nest = mnl_attr_nest_start(nlh, CTA_NAT_SRC);
290 nfct_build_nat(nlh, &ct->snat, l3protonum);
291 nfct_build_protonat(nlh, ct, &ct->snat);
292 mnl_attr_nest_end(nlh, nest);
297nfct_build_snat_ipv4(
struct nlmsghdr *nlh,
const struct nf_conntrack *ct)
301 nest = mnl_attr_nest_start(nlh, CTA_NAT_SRC);
302 nfct_build_nat(nlh, &ct->snat, AF_INET);
303 mnl_attr_nest_end(nlh, nest);
308nfct_build_snat_ipv6(
struct nlmsghdr *nlh,
const struct nf_conntrack *ct)
312 nest = mnl_attr_nest_start(nlh, CTA_NAT_SRC);
313 nfct_build_nat(nlh, &ct->snat, AF_INET6);
314 mnl_attr_nest_end(nlh, nest);
319nfct_build_snat_port(
struct nlmsghdr *nlh,
const struct nf_conntrack *ct)
323 nest = mnl_attr_nest_start(nlh, CTA_NAT_SRC);
324 nfct_build_protonat(nlh, ct, &ct->snat);
325 mnl_attr_nest_end(nlh, nest);
330nfct_build_dnat(
struct nlmsghdr *nlh,
const struct nf_conntrack *ct,
335 nest = mnl_attr_nest_start(nlh, CTA_NAT_DST);
336 nfct_build_nat(nlh, &ct->dnat, l3protonum);
337 nfct_build_protonat(nlh, ct, &ct->dnat);
338 mnl_attr_nest_end(nlh, nest);
343nfct_build_dnat_ipv4(
struct nlmsghdr *nlh,
const struct nf_conntrack *ct)
347 nest = mnl_attr_nest_start(nlh, CTA_NAT_DST);
348 nfct_build_nat(nlh, &ct->dnat, AF_INET);
349 mnl_attr_nest_end(nlh, nest);
354nfct_build_dnat_ipv6(
struct nlmsghdr *nlh,
const struct nf_conntrack *ct)
358 nest = mnl_attr_nest_start(nlh, CTA_NAT_DST);
359 nfct_build_nat(nlh, &ct->dnat, AF_INET6);
360 mnl_attr_nest_end(nlh, nest);
365nfct_build_dnat_port(
struct nlmsghdr *nlh,
const struct nf_conntrack *ct)
369 nest = mnl_attr_nest_start(nlh, CTA_NAT_DST);
370 nfct_build_protonat(nlh, ct, &ct->dnat);
371 mnl_attr_nest_end(nlh, nest);
376nfct_build_status(
struct nlmsghdr *nlh,
const struct nf_conntrack *ct)
378 mnl_attr_put_u32(nlh, CTA_STATUS, htonl(ct->status | IPS_CONFIRMED));
383nfct_build_timeout(
struct nlmsghdr *nlh,
const struct nf_conntrack *ct)
385 mnl_attr_put_u32(nlh, CTA_TIMEOUT, htonl(ct->timeout));
390nfct_build_mark(
struct nlmsghdr *nlh,
const struct nf_conntrack *ct)
392 mnl_attr_put_u32(nlh, CTA_MARK, htonl(ct->mark));
397nfct_build_secmark(
struct nlmsghdr *nlh,
const struct nf_conntrack *ct)
399 mnl_attr_put_u32(nlh, CTA_SECMARK, htonl(ct->secmark));
404nfct_build_helper_name(
struct nlmsghdr *nlh,
const struct nf_conntrack *ct)
408 nest = mnl_attr_nest_start(nlh, CTA_HELP);
409 mnl_attr_put_strz(nlh, CTA_HELP_NAME, ct->helper_name);
411 if (ct->helper_info != NULL) {
412 mnl_attr_put(nlh, CTA_HELP_INFO, ct->helper_info_len,
415 mnl_attr_nest_end(nlh, nest);
420nfct_build_zone(
struct nlmsghdr *nlh,
const struct nf_conntrack *ct)
422 mnl_attr_put_u16(nlh, CTA_ZONE, htons(ct->zone));
427nfct_build_labels(
struct nlmsghdr *nlh,
const struct nf_conntrack *ct)
429 struct nfct_bitmask *b = ct->connlabels;
430 unsigned int size = b->words *
sizeof(b->bits[0]);
431 mnl_attr_put(nlh, CTA_LABELS, size, b->bits);
433 if (test_bit(ATTR_CONNLABELS_MASK, ct->head.set)) {
434 b = ct->connlabels_mask;
435 if (size == (b->words *
sizeof(b->bits[0])))
436 mnl_attr_put(nlh, CTA_LABELS_MASK, size, b->bits);
440static void nfct_build_synproxy(
struct nlmsghdr *nlh,
441 const struct nf_conntrack *ct)
445 nest = mnl_attr_nest_start(nlh, CTA_SYNPROXY);
446 mnl_attr_put_u32(nlh, CTA_SYNPROXY_ISN, htonl(ct->synproxy.isn));
447 mnl_attr_put_u32(nlh, CTA_SYNPROXY_ITS, htonl(ct->synproxy.its));
448 mnl_attr_put_u32(nlh, CTA_SYNPROXY_TSOFF, htonl(ct->synproxy.tsoff));
449 mnl_attr_nest_end(nlh, nest);
453nfct_nlmsg_build(
struct nlmsghdr *nlh,
const struct nf_conntrack *ct)
455 if (!test_bit(ATTR_ORIG_L3PROTO, ct->head.set)) {
460 if (test_bit(ATTR_ORIG_IPV4_SRC, ct->head.set) ||
461 test_bit(ATTR_ORIG_IPV4_DST, ct->head.set) ||
462 test_bit(ATTR_ORIG_IPV6_SRC, ct->head.set) ||
463 test_bit(ATTR_ORIG_IPV6_DST, ct->head.set) ||
464 test_bit(ATTR_ORIG_PORT_SRC, ct->head.set) ||
465 test_bit(ATTR_ORIG_PORT_DST, ct->head.set) ||
466 test_bit(ATTR_ORIG_L3PROTO, ct->head.set) ||
467 test_bit(ATTR_ORIG_L4PROTO, ct->head.set) ||
468 test_bit(ATTR_ORIG_ZONE, ct->head.set) ||
469 test_bit(ATTR_ICMP_TYPE, ct->head.set) ||
470 test_bit(ATTR_ICMP_CODE, ct->head.set) ||
471 test_bit(ATTR_ICMP_ID, ct->head.set)) {
472 const struct __nfct_tuple *t = &ct->head.orig;
475 nest = mnl_attr_nest_start(nlh, CTA_TUPLE_ORIG);
479 if (nfct_build_tuple_raw(nlh, t) < 0) {
480 mnl_attr_nest_cancel(nlh, nest);
484 if (test_bit(ATTR_ORIG_ZONE, ct->head.set))
485 mnl_attr_put_u16(nlh, CTA_TUPLE_ZONE, htons(t->zone));
487 mnl_attr_nest_end(nlh, nest);
490 if (test_bit(ATTR_REPL_IPV4_SRC, ct->head.set) ||
491 test_bit(ATTR_REPL_IPV4_DST, ct->head.set) ||
492 test_bit(ATTR_REPL_IPV6_SRC, ct->head.set) ||
493 test_bit(ATTR_REPL_IPV6_DST, ct->head.set) ||
494 test_bit(ATTR_REPL_PORT_SRC, ct->head.set) ||
495 test_bit(ATTR_REPL_PORT_DST, ct->head.set) ||
496 test_bit(ATTR_REPL_L3PROTO, ct->head.set) ||
497 test_bit(ATTR_REPL_L4PROTO, ct->head.set) ||
498 test_bit(ATTR_REPL_ZONE, ct->head.set)) {
499 const struct __nfct_tuple *t = &ct->repl;
502 nest = mnl_attr_nest_start(nlh, CTA_TUPLE_REPLY);
506 if (nfct_build_tuple_raw(nlh, t) < 0) {
507 mnl_attr_nest_cancel(nlh, nest);
511 if (test_bit(ATTR_REPL_ZONE, ct->head.set))
512 mnl_attr_put_u16(nlh, CTA_TUPLE_ZONE, htons(t->zone));
514 mnl_attr_nest_end(nlh, nest);
517 if (test_bit(ATTR_MASTER_IPV4_SRC, ct->head.set) ||
518 test_bit(ATTR_MASTER_IPV4_DST, ct->head.set) ||
519 test_bit(ATTR_MASTER_IPV6_SRC, ct->head.set) ||
520 test_bit(ATTR_MASTER_IPV6_DST, ct->head.set) ||
521 test_bit(ATTR_MASTER_PORT_SRC, ct->head.set) ||
522 test_bit(ATTR_MASTER_PORT_DST, ct->head.set) ||
523 test_bit(ATTR_MASTER_L3PROTO, ct->head.set) ||
524 test_bit(ATTR_MASTER_L4PROTO, ct->head.set)) {
525 nfct_build_tuple(nlh, &ct->master, CTA_TUPLE_MASTER);
528 if (test_bit(ATTR_STATUS, ct->head.set))
529 nfct_build_status(nlh, ct);
531 if (test_bit(ATTR_TIMEOUT, ct->head.set))
532 nfct_build_timeout(nlh, ct);
534 if (test_bit(ATTR_MARK, ct->head.set))
535 nfct_build_mark(nlh, ct);
537 if (test_bit(ATTR_SECMARK, ct->head.set))
538 nfct_build_secmark(nlh, ct);
540 nfct_build_protoinfo(nlh, ct);
542 if (test_bit(ATTR_SNAT_IPV4, ct->head.set) &&
543 test_bit(ATTR_SNAT_PORT, ct->head.set)) {
544 nfct_build_snat(nlh, ct, AF_INET);
545 }
else if (test_bit(ATTR_SNAT_IPV6, ct->head.set) &&
546 test_bit(ATTR_SNAT_PORT, ct->head.set)) {
547 nfct_build_snat(nlh, ct, AF_INET6);
548 }
else if (test_bit(ATTR_SNAT_IPV4, ct->head.set)) {
549 nfct_build_snat_ipv4(nlh, ct);
550 }
else if (test_bit(ATTR_SNAT_IPV6, ct->head.set)) {
551 nfct_build_snat_ipv6(nlh, ct);
552 }
else if (test_bit(ATTR_SNAT_PORT, ct->head.set)) {
553 nfct_build_snat_port(nlh, ct);
556 if (test_bit(ATTR_DNAT_IPV4, ct->head.set) &&
557 test_bit(ATTR_DNAT_PORT, ct->head.set)) {
558 nfct_build_dnat(nlh, ct, AF_INET);
559 }
else if (test_bit(ATTR_DNAT_IPV6, ct->head.set) &&
560 test_bit(ATTR_DNAT_PORT, ct->head.set)) {
561 nfct_build_dnat(nlh, ct, AF_INET6);
562 }
else if (test_bit(ATTR_DNAT_IPV4, ct->head.set)) {
563 nfct_build_dnat_ipv4(nlh, ct);
564 }
else if (test_bit(ATTR_DNAT_IPV6, ct->head.set)) {
565 nfct_build_dnat_ipv6(nlh, ct);
566 }
else if (test_bit(ATTR_DNAT_PORT, ct->head.set)) {
567 nfct_build_dnat_port(nlh, ct);
570 if (test_bit(ATTR_ORIG_NAT_SEQ_CORRECTION_POS, ct->head.set) &&
571 test_bit(ATTR_ORIG_NAT_SEQ_OFFSET_BEFORE, ct->head.set) &&
572 test_bit(ATTR_ORIG_NAT_SEQ_OFFSET_AFTER, ct->head.set)) {
573 nfct_build_nat_seq_adj(nlh, ct, __DIR_ORIG);
575 if (test_bit(ATTR_REPL_NAT_SEQ_CORRECTION_POS, ct->head.set) &&
576 test_bit(ATTR_REPL_NAT_SEQ_OFFSET_BEFORE, ct->head.set) &&
577 test_bit(ATTR_REPL_NAT_SEQ_OFFSET_AFTER, ct->head.set)) {
578 nfct_build_nat_seq_adj(nlh, ct, __DIR_REPL);
581 if (test_bit(ATTR_HELPER_NAME, ct->head.set))
582 nfct_build_helper_name(nlh, ct);
584 if (test_bit(ATTR_ZONE, ct->head.set))
585 nfct_build_zone(nlh, ct);
587 if (test_bit(ATTR_CONNLABELS, ct->head.set))
588 nfct_build_labels(nlh, ct);
590 if (test_bit(ATTR_SYNPROXY_ISN, ct->head.set) &&
591 test_bit(ATTR_SYNPROXY_ITS, ct->head.set) &&
592 test_bit(ATTR_SYNPROXY_TSOFF, ct->head.set))
593 nfct_build_synproxy(nlh, ct);
598int nfct_nlmsg_build_filter(
struct nlmsghdr *nlh,
599 const struct nfct_filter_dump *filter_dump)
601 struct nfgenmsg *nfg;
603 if (filter_dump->set & (1 << NFCT_FILTER_DUMP_MARK)) {
604 mnl_attr_put_u32(nlh, CTA_MARK, htonl(filter_dump->mark.val));
605 mnl_attr_put_u32(nlh, CTA_MARK_MASK, htonl(filter_dump->mark.mask));
607 if (filter_dump->set & (1 << NFCT_FILTER_DUMP_L3NUM)) {
608 nfg = mnl_nlmsg_get_payload(nlh);
609 nfg->nfgen_family = filter_dump->l3num;
611 if (filter_dump->set & (1 << NFCT_FILTER_DUMP_STATUS)) {
612 mnl_attr_put_u32(nlh, CTA_STATUS, htonl(filter_dump->status.val));
613 mnl_attr_put_u32(nlh, CTA_STATUS_MASK,
614 htonl(filter_dump->status.mask));