Группа :: Система/Библиотеки
Пакет: libnetfilter_cttimeout
навигация по пакетам
Главная Изменения Спек Патчи Исходники Загрузить Gear Bugs and FR Repocop
pax_global_header 0000666 0000000 0000000 00000000064 11760154031 0014510 g ustar 00root root 0000000 0000000 52 comment=329652bef21c831dae1a9a79084b999d40b4eb5b
libnetfilter_cttimeout-1.0.0/ 0000755 0000000 0000000 00000000000 11760154031 0016264 5 ustar 00root root 0000000 0000000 libnetfilter_cttimeout-1.0.0/.gitignore 0000644 0000000 0000000 00000000224 11760154031 0020252 0 ustar 00root root 0000000 0000000 .deps/
.libs/
*.la
*.lo
Makefile
Makefile.in
/aclocal.m4
/autom4te.cache/
/build-aux/
/config.*
/configure
/libtool
/stamp-h1
/doxygen.cfg
/*.pc
libnetfilter_cttimeout-1.0.0/COPYING 0000644 0000000 0000000 00000043076 11760154031 0017331 0 ustar 00root root 0000000 0000000 GNU GENERAL PUBLIC LICENSE
Version 2, June 1991
Copyright (C) 1989, 1991 Free Software Foundation, Inc.
675 Mass Ave, Cambridge, MA 02139, USA
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
Preamble
The licenses for most software are designed to take away your
freedom to share and change it. By contrast, the GNU General Public
License is intended to guarantee your freedom to share and change free
software--to make sure the software is free for all its users. This
General Public License applies to most of the Free Software
Foundation's software and to any other program whose authors commit to
using it. (Some other Free Software Foundation software is covered by
the GNU Library General Public License instead.) You can apply it to
your programs, too.
When we speak of free software, we are referring to freedom, not
price. Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
this service if you wish), that you receive source code or can get it
if you want it, that you can change the software or use pieces of it
in new free programs; and that you know you can do these things.
To protect your rights, we need to make restrictions that forbid
anyone to deny you these rights or to ask you to surrender the rights.
These restrictions translate to certain responsibilities for you if you
distribute copies of the software, or if you modify it.
For example, if you distribute copies of such a program, whether
gratis or for a fee, you must give the recipients all the rights that
you have. You must make sure that they, too, receive or can get the
source code. And you must show them these terms so they know their
rights.
We protect your rights with two steps: (1) copyright the software, and
(2) offer you this license which gives you legal permission to copy,
distribute and/or modify the software.
Also, for each author's protection and ours, we want to make certain
that everyone understands that there is no warranty for this free
software. If the software is modified by someone else and passed on, we
want its recipients to know that what they have is not the original, so
that any problems introduced by others will not reflect on the original
authors' reputations.
Finally, any free program is threatened constantly by software
patents. We wish to avoid the danger that redistributors of a free
program will individually obtain patent licenses, in effect making the
program proprietary. To prevent this, we have made it clear that any
patent must be licensed for everyone's free use or not licensed at all.
The precise terms and conditions for copying, distribution and
modification follow.
GNU GENERAL PUBLIC LICENSE
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
0. This License applies to any program or other work which contains
a notice placed by the copyright holder saying it may be distributed
under the terms of this General Public License. The "Program", below,
refers to any such program or work, and a "work based on the Program"
means either the Program or any derivative work under copyright law:
that is to say, a work containing the Program or a portion of it,
either verbatim or with modifications and/or translated into another
language. (Hereinafter, translation is included without limitation in
the term "modification".) Each licensee is addressed as "you".
Activities other than copying, distribution and modification are not
covered by this License; they are outside its scope. The act of
running the Program is not restricted, and the output from the Program
is covered only if its contents constitute a work based on the
Program (independent of having been made by running the Program).
Whether that is true depends on what the Program does.
1. You may copy and distribute verbatim copies of the Program's
source code as you receive it, in any medium, provided that you
conspicuously and appropriately publish on each copy an appropriate
copyright notice and disclaimer of warranty; keep intact all the
notices that refer to this License and to the absence of any warranty;
and give any other recipients of the Program a copy of this License
along with the Program.
You may charge a fee for the physical act of transferring a copy, and
you may at your option offer warranty protection in exchange for a fee.
2. You may modify your copy or copies of the Program or any portion
of it, thus forming a work based on the Program, and copy and
distribute such modifications or work under the terms of Section 1
above, provided that you also meet all of these conditions:
a) You must cause the modified files to carry prominent notices
stating that you changed the files and the date of any change.
b) You must cause any work that you distribute or publish, that in
whole or in part contains or is derived from the Program or any
part thereof, to be licensed as a whole at no charge to all third
parties under the terms of this License.
c) If the modified program normally reads commands interactively
when run, you must cause it, when started running for such
interactive use in the most ordinary way, to print or display an
announcement including an appropriate copyright notice and a
notice that there is no warranty (or else, saying that you provide
a warranty) and that users may redistribute the program under
these conditions, and telling the user how to view a copy of this
License. (Exception: if the Program itself is interactive but
does not normally print such an announcement, your work based on
the Program is not required to print an announcement.)
These requirements apply to the modified work as a whole. If
identifiable sections of that work are not derived from the Program,
and can be reasonably considered independent and separate works in
themselves, then this License, and its terms, do not apply to those
sections when you distribute them as separate works. But when you
distribute the same sections as part of a whole which is a work based
on the Program, the distribution of the whole must be on the terms of
this License, whose permissions for other licensees extend to the
entire whole, and thus to each and every part regardless of who wrote it.
Thus, it is not the intent of this section to claim rights or contest
your rights to work written entirely by you; rather, the intent is to
exercise the right to control the distribution of derivative or
collective works based on the Program.
In addition, mere aggregation of another work not based on the Program
with the Program (or with a work based on the Program) on a volume of
a storage or distribution medium does not bring the other work under
the scope of this License.
3. You may copy and distribute the Program (or a work based on it,
under Section 2) in object code or executable form under the terms of
Sections 1 and 2 above provided that you also do one of the following:
a) Accompany it with the complete corresponding machine-readable
source code, which must be distributed under the terms of Sections
1 and 2 above on a medium customarily used for software interchange; or,
b) Accompany it with a written offer, valid for at least three
years, to give any third party, for a charge no more than your
cost of physically performing source distribution, a complete
machine-readable copy of the corresponding source code, to be
distributed under the terms of Sections 1 and 2 above on a medium
customarily used for software interchange; or,
c) Accompany it with the information you received as to the offer
to distribute corresponding source code. (This alternative is
allowed only for noncommercial distribution and only if you
received the program in object code or executable form with such
an offer, in accord with Subsection b above.)
The source code for a work means the preferred form of the work for
making modifications to it. For an executable work, complete source
code means all the source code for all modules it contains, plus any
associated interface definition files, plus the scripts used to
control compilation and installation of the executable. However, as a
special exception, the source code distributed need not include
anything that is normally distributed (in either source or binary
form) with the major components (compiler, kernel, and so on) of the
operating system on which the executable runs, unless that component
itself accompanies the executable.
If distribution of executable or object code is made by offering
access to copy from a designated place, then offering equivalent
access to copy the source code from the same place counts as
distribution of the source code, even though third parties are not
compelled to copy the source along with the object code.
4. You may not copy, modify, sublicense, or distribute the Program
except as expressly provided under this License. Any attempt
otherwise to copy, modify, sublicense or distribute the Program is
void, and will automatically terminate your rights under this License.
However, parties who have received copies, or rights, from you under
this License will not have their licenses terminated so long as such
parties remain in full compliance.
5. You are not required to accept this License, since you have not
signed it. However, nothing else grants you permission to modify or
distribute the Program or its derivative works. These actions are
prohibited by law if you do not accept this License. Therefore, by
modifying or distributing the Program (or any work based on the
Program), you indicate your acceptance of this License to do so, and
all its terms and conditions for copying, distributing or modifying
the Program or works based on it.
6. Each time you redistribute the Program (or any work based on the
Program), the recipient automatically receives a license from the
original licensor to copy, distribute or modify the Program subject to
these terms and conditions. You may not impose any further
restrictions on the recipients' exercise of the rights granted herein.
You are not responsible for enforcing compliance by third parties to
this License.
7. If, as a consequence of a court judgment or allegation of patent
infringement or for any other reason (not limited to patent issues),
conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot
distribute so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you
may not distribute the Program at all. For example, if a patent
license would not permit royalty-free redistribution of the Program by
all those who receive copies directly or indirectly through you, then
the only way you could satisfy both it and this License would be to
refrain entirely from distribution of the Program.
If any portion of this section is held invalid or unenforceable under
any particular circumstance, the balance of the section is intended to
apply and the section as a whole is intended to apply in other
circumstances.
It is not the purpose of this section to induce you to infringe any
patents or other property right claims or to contest validity of any
such claims; this section has the sole purpose of protecting the
integrity of the free software distribution system, which is
implemented by public license practices. Many people have made
generous contributions to the wide range of software distributed
through that system in reliance on consistent application of that
system; it is up to the author/donor to decide if he or she is willing
to distribute software through any other system and a licensee cannot
impose that choice.
This section is intended to make thoroughly clear what is believed to
be a consequence of the rest of this License.
8. If the distribution and/or use of the Program is restricted in
certain countries either by patents or by copyrighted interfaces, the
original copyright holder who places the Program under this License
may add an explicit geographical distribution limitation excluding
those countries, so that distribution is permitted only in or among
countries not thus excluded. In such case, this License incorporates
the limitation as if written in the body of this License.
9. The Free Software Foundation may publish revised and/or new versions
of the General Public License from time to time. Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.
Each version is given a distinguishing version number. If the Program
specifies a version number of this License which applies to it and "any
later version", you have the option of following the terms and conditions
either of that version or of any later version published by the Free
Software Foundation. If the Program does not specify a version number of
this License, you may choose any version ever published by the Free Software
Foundation.
10. If you wish to incorporate parts of the Program into other free
programs whose distribution conditions are different, write to the author
to ask for permission. For software which is copyrighted by the Free
Software Foundation, write to the Free Software Foundation; we sometimes
make exceptions for this. Our decision will be guided by the two goals
of preserving the free status of all derivatives of our free software and
of promoting the sharing and reuse of software generally.
NO WARRANTY
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
REPAIR OR CORRECTION.
12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.
END OF TERMS AND CONDITIONS
Appendix: How to Apply These Terms to Your New Programs
If you develop a new program, and you want it to be of the greatest
possible use to the public, the best way to achieve this is to make it
free software which everyone can redistribute and change under these terms.
To do so, attach the following notices to the program. It is safest
to attach them to the start of each source file to most effectively
convey the exclusion of warranty; and each file should have at least
the "copyright" line and a pointer to where the full notice is found.
<one line to give the program's name and a brief idea of what it does.>
Copyright (C) 19yy <name of author>
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
Also add information on how to contact you by electronic and paper mail.
If the program is interactive, make it output a short notice like this
when it starts in an interactive mode:
Gnomovision version 69, Copyright (C) 19yy name of author
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
This is free software, and you are welcome to redistribute it
under certain conditions; type `show c' for details.
The hypothetical commands `show w' and `show c' should show the appropriate
parts of the General Public License. Of course, the commands you use may
be called something other than `show w' and `show c'; they could even be
mouse-clicks or menu items--whatever suits your program.
You should also get your employer (if you work as a programmer) or your
school, if any, to sign a "copyright disclaimer" for the program, if
necessary. Here is a sample; alter the names:
Yoyodyne, Inc., hereby disclaims all copyright interest in the program
`Gnomovision' (which makes passes at compilers) written by James Hacker.
<signature of Ty Coon>, 1 April 1989
Ty Coon, President of Vice
This General Public License does not permit incorporating your program into
proprietary programs. If your program is a subroutine library, you may
consider it more useful to permit linking proprietary applications with the
library. If this is what you want to do, use the GNU Library General
Public License instead of this License.
libnetfilter_cttimeout-1.0.0/Make_global.am 0000644 0000000 0000000 00000002147 11760154031 0021004 0 ustar 00root root 0000000 0000000 # This is _NOT_ the library release version, it's an API version.
# Extracted from Chapter 6 "Library interface versions" of the libtool docs.
#
# <snippet>
# Here are a set of rules to help you update your library version information:
#
# 1. Start with version information of `0:0:0' for each libtool library.
# 2. Update the version information only immediately before a public release
# of your software. More frequent updates are unnecessary, and only guarantee
# that the current interface number gets larger faster.
# 3. If the library source code has changed at all since the last update,
# then increment revision (`c:r:a' becomes `c:r+1:a').
# 4. If any interfaces have been added, removed, or changed since the last
# update, increment current, and set revision to 0.
# 5. If any interfaces have been added since the last public release, then
# increment age.
# 6. If any interfaces have been removed since the last public release, then
# set age to 0.
# </snippet>
#
LIBVERSION=1:0:0
AM_CPPFLAGS = ${regular_CPPFLAGS} -I${top_srcdir}/include ${LIBMNL_CFLAGS}
AM_CFLAGS = ${regular_CFLAGS} ${GCC_FVISIBILITY_HIDDEN}
libnetfilter_cttimeout-1.0.0/Makefile.am 0000644 0000000 0000000 00000000403 11760154031 0020315 0 ustar 00root root 0000000 0000000 include $(top_srcdir)/Make_global.am
ACLOCAL_AMFLAGS = -I m4
SUBDIRS = src include examples
DIST_SUBDIRS = src include examples
pkgconfigdir = $(libdir)/pkgconfig
pkgconfig_DATA = libnetfilter_cttimeout.pc
${pkgconfig_DATA}: ${top_builddir}/config.status
libnetfilter_cttimeout-1.0.0/README 0000644 0000000 0000000 00000003666 11760154031 0017157 0 ustar 00root root 0000000 0000000 = cttimeout: timeout policy tuning for Netfilter/conntrack =
This infrastructure allows you to define fine-grain timeout
policies per flow. Basically, from user-space, you can create
timeout policy objects via nfct_timeout_alloc(), set the
policy attributes, via nfct_timeout_*_attr_set(), and then
build the ctnetlink message to communicate this new timeout
policy to the kernel.
ctnetlink keeps a list of existing policies that are identified
by one name. Timeout policies can be attached to flows via the
iptables CT target.
This is useful in case you want to reduce the timeout of TCP
Established state to 3000 seconds instead of default 432000
seconds for certain flows. The infrastructure allows fine
tuning of all existing protocol trackers and even modifying
the timeout for several states for one given protocol.
This new infrastructure uses libmnl, thus, libnetfilter_conntrack
remains in intermediate state, meaning that it depends on
libnfnetlink and libmnl. This should not be a problem since
we'll require this dual support during the transition to the
new libnetfilter_conntrack API.
Under examples/ directory, you can find examples on how to
create new timeout policies, delete them and to retrieve the
existing list of policies.
1) You can create one dummy timeout policy:
examples# ./nfct-timeout-add test 2 6
2) You can retrieve the policy that is known by `test':
examples# ./nfct-timeout-get test
.test = {
.l3proto = 2,
.l4proto = 6,
.policy = {
.SYN_SENT = 100,
.SYN_RECV = 120,
.ESTABLISHED = 60,
.FIN_WAIT = 432000,
.CLOSE_WAIT = 120,
.LAST_ACK = 60,
.TIME_WAIT = 30,
.CLOSE = 120,
.SYN_SENT2 = 10,
},
};
3) You may want to retrieve all timeout policies:
examples# ./nfct-timeout-get
The kernel-space part is planned to be available since Linux
kernel >= 3.4.0.
libnetfilter_cttimeout-1.0.0/configure.ac 0000644 0000000 0000000 00000002053 11760154031 0020552 0 ustar 00root root 0000000 0000000 dnl Process this file with autoconf to create configure.
AC_INIT([libnetfilter_cttimeout], [1.0.0])
AC_CONFIG_AUX_DIR([build-aux])
AC_CANONICAL_HOST
AC_CONFIG_MACRO_DIR([m4])
AC_CONFIG_HEADERS([config.h])
AM_INIT_AUTOMAKE([-Wall foreign tar-pax no-dist-gzip dist-bzip2
1.6 subdir-objects])
dnl kernel style compile messages
m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
dnl Dependencies
PKG_CHECK_MODULES([LIBMNL], [libmnl >= 1.0.0])
AC_PROG_CC
AM_PROG_CC_C_O
AC_DISABLE_STATIC
LT_INIT
CHECK_GCC_FVISIBILITY
case "$host" in
*-*-linux*) ;;
*) AC_MSG_ERROR([Linux only, dude!]);;
esac
regular_CPPFLAGS="-D_FILE_OFFSET_BITS=64 -D_REENTRANT"
regular_CFLAGS="-Wall -Waggregate-return -Wmissing-declarations \
-Wmissing-prototypes -Wshadow -Wstrict-prototypes \
-Wformat=2 -pipe"
AC_SUBST([regular_CPPFLAGS])
AC_SUBST([regular_CFLAGS])
AC_CONFIG_FILES([Makefile src/Makefile include/Makefile include/libnetfilter_cttimeout/Makefile include/linux/Makefile include/linux/netfilter/Makefile examples/Makefile libnetfilter_cttimeout.pc doxygen.cfg])
AC_OUTPUT
libnetfilter_cttimeout-1.0.0/doxygen.cfg.in 0000644 0000000 0000000 00000012325 11760154031 0021032 0 ustar 00root root 0000000 0000000 DOXYFILE_ENCODING = UTF-8
PROJECT_NAME = @PACKAGE@
PROJECT_NUMBER = @VERSION@
OUTPUT_DIRECTORY = doxygen
CREATE_SUBDIRS = NO
OUTPUT_LANGUAGE = English
BRIEF_MEMBER_DESC = YES
REPEAT_BRIEF = YES
ABBREVIATE_BRIEF =
ALWAYS_DETAILED_SEC = NO
INLINE_INHERITED_MEMB = NO
FULL_PATH_NAMES = NO
STRIP_FROM_PATH =
STRIP_FROM_INC_PATH =
SHORT_NAMES = NO
JAVADOC_AUTOBRIEF = NO
QT_AUTOBRIEF = NO
MULTILINE_CPP_IS_BRIEF = NO
INHERIT_DOCS = YES
SEPARATE_MEMBER_PAGES = NO
TAB_SIZE = 8
ALIASES =
OPTIMIZE_OUTPUT_FOR_C = YES
OPTIMIZE_OUTPUT_JAVA = NO
OPTIMIZE_FOR_FORTRAN = NO
OPTIMIZE_OUTPUT_VHDL = NO
BUILTIN_STL_SUPPORT = NO
CPP_CLI_SUPPORT = NO
SIP_SUPPORT = NO
DISTRIBUTE_GROUP_DOC = NO
SUBGROUPING = YES
TYPEDEF_HIDES_STRUCT = NO
EXTRACT_ALL = NO
EXTRACT_PRIVATE = NO
EXTRACT_STATIC = NO
EXTRACT_LOCAL_CLASSES = YES
EXTRACT_LOCAL_METHODS = NO
EXTRACT_ANON_NSPACES = NO
HIDE_UNDOC_MEMBERS = NO
HIDE_UNDOC_CLASSES = NO
HIDE_FRIEND_COMPOUNDS = NO
HIDE_IN_BODY_DOCS = NO
INTERNAL_DOCS = NO
CASE_SENSE_NAMES = YES
HIDE_SCOPE_NAMES = NO
SHOW_INCLUDE_FILES = YES
INLINE_INFO = YES
SORT_MEMBER_DOCS = YES
SORT_BRIEF_DOCS = NO
SORT_GROUP_NAMES = NO
SORT_BY_SCOPE_NAME = NO
GENERATE_TODOLIST = YES
GENERATE_TESTLIST = YES
GENERATE_BUGLIST = YES
GENERATE_DEPRECATEDLIST= YES
ENABLED_SECTIONS =
MAX_INITIALIZER_LINES = 30
SHOW_USED_FILES = YES
SHOW_DIRECTORIES = NO
FILE_VERSION_FILTER =
QUIET = NO
WARNINGS = YES
WARN_IF_UNDOCUMENTED = YES
WARN_IF_DOC_ERROR = YES
WARN_NO_PARAMDOC = NO
WARN_FORMAT = "$file:$line: $text"
WARN_LOGFILE =
INPUT = .
INPUT_ENCODING = UTF-8
FILE_PATTERNS = *.c libnetfilter_cttimeout.h
RECURSIVE = YES
EXCLUDE =
EXCLUDE_SYMLINKS = NO
EXCLUDE_PATTERNS = */.git/* .*.d
EXCLUDE_SYMBOLS = EXPORT_SYMBOL nfct_timeout _container_policy_cb
EXAMPLE_PATH =
EXAMPLE_PATTERNS =
EXAMPLE_RECURSIVE = NO
IMAGE_PATH =
INPUT_FILTER =
FILTER_PATTERNS =
FILTER_SOURCE_FILES = NO
SOURCE_BROWSER = YES
INLINE_SOURCES = NO
STRIP_CODE_COMMENTS = YES
REFERENCED_BY_RELATION = NO
REFERENCES_RELATION = NO
REFERENCES_LINK_SOURCE = YES
USE_HTAGS = NO
VERBATIM_HEADERS = YES
ALPHABETICAL_INDEX = NO
COLS_IN_ALPHA_INDEX = 5
IGNORE_PREFIX =
GENERATE_HTML = YES
HTML_OUTPUT = html
HTML_FILE_EXTENSION = .html
HTML_HEADER =
HTML_STYLESHEET =
HTML_ALIGN_MEMBERS = YES
GENERATE_HTMLHELP = NO
GENERATE_DOCSET = NO
DOCSET_FEEDNAME = "Doxygen generated docs"
DOCSET_BUNDLE_ID = org.doxygen.Project
HTML_DYNAMIC_SECTIONS = NO
CHM_FILE =
HHC_LOCATION =
GENERATE_CHI = NO
BINARY_TOC = NO
TOC_EXPAND = NO
DISABLE_INDEX = NO
ENUM_VALUES_PER_LINE = 4
GENERATE_TREEVIEW = NO
TREEVIEW_WIDTH = 250
GENERATE_LATEX = NO
LATEX_OUTPUT = latex
LATEX_CMD_NAME = latex
MAKEINDEX_CMD_NAME = makeindex
COMPACT_LATEX = NO
PAPER_TYPE = a4wide
EXTRA_PACKAGES =
LATEX_HEADER =
PDF_HYPERLINKS = YES
USE_PDFLATEX = YES
LATEX_BATCHMODE = NO
LATEX_HIDE_INDICES = NO
GENERATE_RTF = NO
RTF_OUTPUT = rtf
COMPACT_RTF = NO
RTF_HYPERLINKS = NO
RTF_STYLESHEET_FILE =
RTF_EXTENSIONS_FILE =
GENERATE_MAN = YES
MAN_OUTPUT = man
MAN_EXTENSION = .3
MAN_LINKS = NO
GENERATE_XML = NO
XML_OUTPUT = xml
XML_SCHEMA =
XML_DTD =
XML_PROGRAMLISTING = YES
GENERATE_AUTOGEN_DEF = NO
GENERATE_PERLMOD = NO
PERLMOD_LATEX = NO
PERLMOD_PRETTY = YES
PERLMOD_MAKEVAR_PREFIX =
ENABLE_PREPROCESSING = YES
MACRO_EXPANSION = NO
EXPAND_ONLY_PREDEF = NO
SEARCH_INCLUDES = YES
INCLUDE_PATH =
INCLUDE_FILE_PATTERNS =
PREDEFINED =
EXPAND_AS_DEFINED =
SKIP_FUNCTION_MACROS = YES
TAGFILES =
GENERATE_TAGFILE =
ALLEXTERNALS = NO
EXTERNAL_GROUPS = YES
PERL_PATH = /usr/bin/perl
CLASS_DIAGRAMS = YES
MSCGEN_PATH =
HIDE_UNDOC_RELATIONS = YES
HAVE_DOT = YES
CLASS_GRAPH = YES
COLLABORATION_GRAPH = YES
GROUP_GRAPHS = YES
UML_LOOK = NO
TEMPLATE_RELATIONS = NO
INCLUDE_GRAPH = YES
INCLUDED_BY_GRAPH = YES
CALL_GRAPH = NO
CALLER_GRAPH = NO
GRAPHICAL_HIERARCHY = YES
DIRECTORY_GRAPH = YES
DOT_IMAGE_FORMAT = png
DOT_PATH =
DOTFILE_DIRS =
DOT_GRAPH_MAX_NODES = 50
MAX_DOT_GRAPH_DEPTH = 0
DOT_TRANSPARENT = YES
DOT_MULTI_TARGETS = NO
GENERATE_LEGEND = YES
DOT_CLEANUP = YES
SEARCHENGINE = NO
libnetfilter_cttimeout-1.0.0/examples/ 0000755 0000000 0000000 00000000000 11760154031 0020102 5 ustar 00root root 0000000 0000000 libnetfilter_cttimeout-1.0.0/examples/Makefile.am 0000644 0000000 0000000 00000000516 11760154031 0022140 0 ustar 00root root 0000000 0000000 include $(top_srcdir)/Make_global.am
check_PROGRAMS = nfct-timeout-add \
nfct-timeout-get
nfct_timeout_add_SOURCES = nfct-timeout-add.c
nfct_timeout_add_LDADD = ../src/libnetfilter_cttimeout.la ${LIBMNL_LIBS}
nfct_timeout_get_SOURCES = nfct-timeout-get.c
nfct_timeout_get_LDADD = ../src/libnetfilter_cttimeout.la ${LIBMNL_LIBS}
libnetfilter_cttimeout-1.0.0/examples/nfct-timeout-add.c 0000644 0000000 0000000 00000004206 11760154031 0023414 0 ustar 00root root 0000000 0000000 /*
* (C) 2005-2012 by Pablo Neira Ayuso <pablo@netfilter.org>
* (C) 2012 by Vyatta Inc. <http://www.vyatta.com>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*/
#include <stdlib.h>
#include <time.h>
#include <string.h>
#include <netinet/in.h>
#include <libmnl/libmnl.h>
#include <linux/netfilter/nfnetlink_cttimeout.h>
#include <libnetfilter_cttimeout/libnetfilter_cttimeout.h>
int main(int argc, char *argv[])
{
struct mnl_socket *nl;
char buf[MNL_SOCKET_BUFFER_SIZE];
struct nlmsghdr *nlh;
uint32_t portid, seq;
struct nfct_timeout *t;
int ret;
if (argc != 4) {
fprintf(stderr, "Usage: %s [name] [l3proto] [l4proto]\n",
argv[0]);
fprintf(stderr, "Example: %s test 2 255\n", argv[0]);
exit(EXIT_FAILURE);
}
t = nfct_timeout_alloc();
if (t == NULL) {
perror("OOM");
exit(EXIT_FAILURE);
}
nfct_timeout_attr_set(t, NFCT_TIMEOUT_ATTR_NAME, argv[1]);
nfct_timeout_attr_set_u16(t, NFCT_TIMEOUT_ATTR_L3PROTO, atoi(argv[2]));
nfct_timeout_attr_set_u8(t, NFCT_TIMEOUT_ATTR_L4PROTO, atoi(argv[3]));
nfct_timeout_policy_attr_set_u32(t, NFCT_TIMEOUT_ATTR_GENERIC, 100);
seq = time(NULL);
nlh = nfct_timeout_nlmsg_build_hdr(buf, IPCTNL_MSG_TIMEOUT_NEW,
NLM_F_CREATE | NLM_F_ACK, seq);
nfct_timeout_nlmsg_build_payload(nlh, t);
nfct_timeout_free(t);
nl = mnl_socket_open(NETLINK_NETFILTER);
if (nl == NULL) {
perror("mnl_socket_open");
exit(EXIT_FAILURE);
}
if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) {
perror("mnl_socket_bind");
exit(EXIT_FAILURE);
}
portid = mnl_socket_get_portid(nl);
if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
perror("mnl_socket_send");
exit(EXIT_FAILURE);
}
ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
while (ret > 0) {
ret = mnl_cb_run(buf, ret, seq, portid, NULL, NULL);
if (ret <= 0)
break;
ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
}
if (ret == -1) {
perror("error");
exit(EXIT_FAILURE);
}
mnl_socket_close(nl);
return EXIT_SUCCESS;
}
libnetfilter_cttimeout-1.0.0/examples/nfct-timeout-get.c 0000644 0000000 0000000 00000004541 11760154031 0023445 0 ustar 00root root 0000000 0000000 /*
* (C) 2005-2012 by Pablo Neira Ayuso <pablo@netfilter.org>
* (C) 2012 by Vyatta Inc. <http://www.vyatta.com>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*/
#include <stdlib.h>
#include <time.h>
#include <string.h>
#include <netinet/in.h>
#include <linux/netfilter/nfnetlink_cttimeout.h>
#include <libmnl/libmnl.h>
#include <libnetfilter_cttimeout/libnetfilter_cttimeout.h>
static int timeout_cb(const struct nlmsghdr *nlh, void *data)
{
struct nfct_timeout *t;
char buf[4096];
t = nfct_timeout_alloc();
if (t == NULL) {
perror("OOM");
goto err;
}
if (nfct_timeout_nlmsg_parse_payload(nlh, t) < 0) {
perror("nfct_timeout_nlmsg_parse_payload");
goto err_free;
}
nfct_timeout_snprintf(buf, sizeof(buf), t, NFCT_TIMEOUT_O_DEFAULT, 0);
printf("%s\n", buf);
err_free:
nfct_timeout_free(t);
err:
return MNL_CB_OK;
}
int main(int argc, char *argv[])
{
struct mnl_socket *nl;
char buf[MNL_SOCKET_BUFFER_SIZE];
struct nlmsghdr *nlh;
uint32_t portid, seq;
struct nfct_timeout *t = NULL;
int ret;
if (argc == 2) {
t = nfct_timeout_alloc();
if (t == NULL) {
perror("OOM");
exit(EXIT_FAILURE);
}
}
seq = time(NULL);
if (t == NULL) {
nlh = nfct_timeout_nlmsg_build_hdr(buf, IPCTNL_MSG_TIMEOUT_GET,
NLM_F_DUMP, seq);
} else {
nlh = nfct_timeout_nlmsg_build_hdr(buf, IPCTNL_MSG_TIMEOUT_GET,
NLM_F_ACK, seq);
nfct_timeout_attr_set(t, NFCT_TIMEOUT_ATTR_NAME, argv[1]);
nfct_timeout_nlmsg_build_payload(nlh, t);
nfct_timeout_free(t);
}
nl = mnl_socket_open(NETLINK_NETFILTER);
if (nl == NULL) {
perror("mnl_socket_open");
exit(EXIT_FAILURE);
}
if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) {
perror("mnl_socket_bind");
exit(EXIT_FAILURE);
}
portid = mnl_socket_get_portid(nl);
if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
perror("mnl_socket_send");
exit(EXIT_FAILURE);
}
ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
while (ret > 0) {
ret = mnl_cb_run(buf, ret, seq, portid, timeout_cb, NULL);
if (ret <= 0)
break;
ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
}
if (ret == -1) {
perror("error");
exit(EXIT_FAILURE);
}
mnl_socket_close(nl);
return EXIT_SUCCESS;
}
libnetfilter_cttimeout-1.0.0/include/ 0000755 0000000 0000000 00000000000 11760154031 0017707 5 ustar 00root root 0000000 0000000 libnetfilter_cttimeout-1.0.0/include/Makefile.am 0000644 0000000 0000000 00000000047 11760154031 0021744 0 ustar 00root root 0000000 0000000 SUBDIRS = libnetfilter_cttimeout linux
libnetfilter_cttimeout-1.0.0/include/libnetfilter_cttimeout/ 0000755 0000000 0000000 00000000000 11760154031 0024467 5 ustar 00root root 0000000 0000000 libnetfilter_cttimeout-1.0.0/include/libnetfilter_cttimeout/Makefile.am 0000644 0000000 0000000 00000000056 11760154031 0026524 0 ustar 00root root 0000000 0000000 pkginclude_HEADERS = libnetfilter_cttimeout.h
libnetfilter_cttimeout-1.0.0/include/libnetfilter_cttimeout/libnetfilter_cttimeout.h 0000644 0000000 0000000 00000006411 11760154031 0031422 0 ustar 00root root 0000000 0000000 #ifndef _LIBNETFILTER_CTTIMEOUT_H_
#define _LIBNETFILTER_CTTIMEOUT_H_
#include <stdint.h>
#include <sys/types.h>
#include <linux/netfilter/nfnetlink_conntrack.h>
#ifdef __cplusplus
extern "C" {
#endif
struct nfct_timeout;
struct nfct_timeout *nfct_timeout_alloc(void);
void nfct_timeout_free(struct nfct_timeout *);
enum nfct_timeout_attr {
NFCT_TIMEOUT_ATTR_NAME= 0,
NFCT_TIMEOUT_ATTR_L3PROTO,
NFCT_TIMEOUT_ATTR_L4PROTO,
NFCT_TIMEOUT_ATTR_POLICY,
NFCT_TIMEOUT_ATTR_MAX
};
enum nfct_timeout_tcp_attr {
NFCT_TIMEOUT_ATTR_TCP_SYN_SENT = 0,
NFCT_TIMEOUT_ATTR_TCP_SYN_RECV,
NFCT_TIMEOUT_ATTR_TCP_ESTABLISHED,
NFCT_TIMEOUT_ATTR_TCP_FIN_WAIT,
NFCT_TIMEOUT_ATTR_TCP_CLOSE_WAIT,
NFCT_TIMEOUT_ATTR_TCP_LAST_ACK,
NFCT_TIMEOUT_ATTR_TCP_TIME_WAIT,
NFCT_TIMEOUT_ATTR_TCP_CLOSE,
NFCT_TIMEOUT_ATTR_TCP_SYN_SENT2,
NFCT_TIMEOUT_ATTR_TCP_RETRANS,
NFCT_TIMEOUT_ATTR_TCP_UNACK,
NFCT_TIMEOUT_ATTR_TCP_MAX
};
enum nfct_timeout_udp_attr {
NFCT_TIMEOUT_ATTR_UDP_UNREPLIED = 0,
NFCT_TIMEOUT_ATTR_UDP_REPLIED,
NFCT_TIMEOUT_ATTR_UDP_MAX
};
enum nfct_timeout_udplite_attr {
NFCT_TIMEOUT_ATTR_UDPLITE_UNREPLIED = 0,
NFCT_TIMEOUT_ATTR_UDPLITE_REPLIED,
NFCT_TIMEOUT_ATTR_UDPLITE_MAX
};
enum nfct_timeout_dccp_attr {
NFCT_TIMEOUT_ATTR_DCCP_REQUEST,
NFCT_TIMEOUT_ATTR_DCCP_RESPOND,
NFCT_TIMEOUT_ATTR_DCCP_PARTOPEN,
NFCT_TIMEOUT_ATTR_DCCP_OPEN,
NFCT_TIMEOUT_ATTR_DCCP_CLOSEREQ,
NFCT_TIMEOUT_ATTR_DCCP_CLOSING,
NFCT_TIMEOUT_ATTR_DCCP_TIMEWAIT,
NFCT_TIMEOUT_ATTR_DCCP_MAX
};
enum nfct_timeout_sctp_attr {
NFCT_TIMEOUT_ATTR_SCTP_CLOSED = 0,
NFCT_TIMEOUT_ATTR_SCTP_COOKIE_WAIT,
NFCT_TIMEOUT_ATTR_SCTP_COOKIE_ECHOED,
NFCT_TIMEOUT_ATTR_SCTP_ESTABLISHED,
NFCT_TIMEOUT_ATTR_SCTP_SHUTDOWN_SENT,
NFCT_TIMEOUT_ATTR_SCTP_SHUTDOWN_RECD,
NFCT_TIMEOUT_ATTR_SCTP_SHUTDOWN_ACK_SENT,
NFCT_TIMEOUT_ATTR_SCTP_MAX
};
enum nfct_timeout_icmp_attr {
NFCT_TIMEOUT_ATTR_ICMP = 0,
NFCT_TIMEOUT_ATTR_ICMP_MAX
};
enum nfct_timeout_icmpv6_attr {
NFCT_TIMEOUT_ATTR_ICMPV6 = 0,
NFCT_TIMEOUT_ATTR_ICMPV6_MAX
};
enum nfct_timeout_gre_attr {
NFCT_TIMEOUT_ATTR_GRE_UNREPLIED = 0,
NFCT_TIMEOUT_ATTR_GRE_REPLIED,
NFCT_TIMEOUT_ATTR_GRE_MAX
};
enum nfct_timeout_generic_attr {
NFCT_TIMEOUT_ATTR_GENERIC = 0,
NFCT_TIMEOUT_ATTR_GENERIC_MAX
};
int nfct_timeout_attr_set(struct nfct_timeout *t, uint32_t type, const void *data);
int nfct_timeout_attr_set_u8(struct nfct_timeout *t, uint32_t type, uint8_t data);
int nfct_timeout_attr_set_u16(struct nfct_timeout *t, uint32_t type, uint16_t data);
void nfct_timeout_attr_unset(struct nfct_timeout *t, uint32_t type);
const char *nfct_timeout_policy_attr_to_name(uint8_t l4proto, uint32_t state);
int nfct_timeout_policy_attr_set_u32(struct nfct_timeout *, uint32_t type, uint32_t data);
void nfct_timeout_policy_attr_unset(struct nfct_timeout *t, uint32_t type);
struct nlmsghdr;
struct nlmsghdr *nfct_timeout_nlmsg_build_hdr(char *buf, uint8_t cmd, uint16_t flags, uint32_t seq);
void nfct_timeout_nlmsg_build_payload(struct nlmsghdr *, const struct nfct_timeout *);
int nfct_timeout_nlmsg_parse_payload(const struct nlmsghdr *nlh, struct nfct_timeout *);
enum {
NFCT_TIMEOUT_O_DEFAULT,
};
int nfct_timeout_snprintf(char *buf, size_t size, const struct nfct_timeout *, unsigned int type, unsigned int flags);
#ifdef __cplusplus
} /* extern "C" */
#endif
#endif /* _LIBNETFILTER_CTTIMEOUT_H_ */
libnetfilter_cttimeout-1.0.0/include/linux/ 0000755 0000000 0000000 00000000000 11760154031 0021046 5 ustar 00root root 0000000 0000000 libnetfilter_cttimeout-1.0.0/include/linux/Makefile.am 0000644 0000000 0000000 00000000024 11760154031 0023076 0 ustar 00root root 0000000 0000000 SUBDIRS = netfilter
libnetfilter_cttimeout-1.0.0/include/linux/netfilter/ 0000755 0000000 0000000 00000000000 11760154031 0023042 5 ustar 00root root 0000000 0000000 libnetfilter_cttimeout-1.0.0/include/linux/netfilter/Makefile.am 0000644 0000000 0000000 00000000106 11760154031 0025073 0 ustar 00root root 0000000 0000000 noinst_HEADERS = nfnetlink.h nfnetlink_cttimeout.h nf_conntrack_tcp.h
libnetfilter_cttimeout-1.0.0/include/linux/netfilter/nf_conntrack_tcp.h 0000644 0000000 0000000 00000004370 11760154031 0026532 0 ustar 00root root 0000000 0000000 #ifndef _NF_CONNTRACK_TCP_H
#define _NF_CONNTRACK_TCP_H
/* TCP tracking. */
#include <linux/types.h>
/* This is exposed to userspace (ctnetlink) */
enum tcp_conntrack {
TCP_CONNTRACK_NONE,
TCP_CONNTRACK_SYN_SENT,
TCP_CONNTRACK_SYN_RECV,
TCP_CONNTRACK_ESTABLISHED,
TCP_CONNTRACK_FIN_WAIT,
TCP_CONNTRACK_CLOSE_WAIT,
TCP_CONNTRACK_LAST_ACK,
TCP_CONNTRACK_TIME_WAIT,
TCP_CONNTRACK_CLOSE,
TCP_CONNTRACK_LISTEN, /* obsolete */
#define TCP_CONNTRACK_SYN_SENT2 TCP_CONNTRACK_LISTEN
TCP_CONNTRACK_MAX,
TCP_CONNTRACK_IGNORE,
TCP_CONNTRACK_RETRANS,
TCP_CONNTRACK_UNACK,
TCP_CONNTRACK_TIMEOUT_MAX
};
/* Window scaling is advertised by the sender */
#define IP_CT_TCP_FLAG_WINDOW_SCALE 0x01
/* SACK is permitted by the sender */
#define IP_CT_TCP_FLAG_SACK_PERM 0x02
/* This sender sent FIN first */
#define IP_CT_TCP_FLAG_CLOSE_INIT 0x04
/* Be liberal in window checking */
#define IP_CT_TCP_FLAG_BE_LIBERAL 0x08
/* Has unacknowledged data */
#define IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED 0x10
/* The field td_maxack has been set */
#define IP_CT_TCP_FLAG_MAXACK_SET 0x20
struct nf_ct_tcp_flags {
__u8 flags;
__u8 mask;
};
#ifdef __KERNEL__
struct ip_ct_tcp_state {
u_int32_t td_end; /* max of seq + len */
u_int32_t td_maxend; /* max of ack + max(win, 1) */
u_int32_t td_maxwin; /* max(win) */
u_int32_t td_maxack; /* max of ack */
u_int8_t td_scale; /* window scale factor */
u_int8_t flags; /* per direction options */
};
struct ip_ct_tcp {
struct ip_ct_tcp_state seen[2]; /* connection parameters per direction */
u_int8_t state; /* state of the connection (enum tcp_conntrack) */
/* For detecting stale connections */
u_int8_t last_dir; /* Direction of the last packet (enum ip_conntrack_dir) */
u_int8_t retrans; /* Number of retransmitted packets */
u_int8_t last_index; /* Index of the last packet */
u_int32_t last_seq; /* Last sequence number seen in dir */
u_int32_t last_ack; /* Last sequence number seen in opposite dir */
u_int32_t last_end; /* Last seq + len */
u_int16_t last_win; /* Last window advertisement seen in dir */
/* For SYN packets while we may be out-of-sync */
u_int8_t last_wscale; /* Last window scaling factor seen */
u_int8_t last_flags; /* Last flags set */
};
#endif /* __KERNEL__ */
#endif /* _NF_CONNTRACK_TCP_H */
libnetfilter_cttimeout-1.0.0/include/linux/netfilter/nfnetlink.h 0000644 0000000 0000000 00000005750 11760154031 0025212 0 ustar 00root root 0000000 0000000 #ifndef _NFNETLINK_H
#define _NFNETLINK_H
#include <linux/types.h>
#include <linux/netfilter/nfnetlink_compat.h>
enum nfnetlink_groups {
NFNLGRP_NONE,
#define NFNLGRP_NONE NFNLGRP_NONE
NFNLGRP_CONNTRACK_NEW,
#define NFNLGRP_CONNTRACK_NEW NFNLGRP_CONNTRACK_NEW
NFNLGRP_CONNTRACK_UPDATE,
#define NFNLGRP_CONNTRACK_UPDATE NFNLGRP_CONNTRACK_UPDATE
NFNLGRP_CONNTRACK_DESTROY,
#define NFNLGRP_CONNTRACK_DESTROY NFNLGRP_CONNTRACK_DESTROY
NFNLGRP_CONNTRACK_EXP_NEW,
#define NFNLGRP_CONNTRACK_EXP_NEW NFNLGRP_CONNTRACK_EXP_NEW
NFNLGRP_CONNTRACK_EXP_UPDATE,
#define NFNLGRP_CONNTRACK_EXP_UPDATE NFNLGRP_CONNTRACK_EXP_UPDATE
NFNLGRP_CONNTRACK_EXP_DESTROY,
#define NFNLGRP_CONNTRACK_EXP_DESTROY NFNLGRP_CONNTRACK_EXP_DESTROY
__NFNLGRP_MAX,
};
#define NFNLGRP_MAX (__NFNLGRP_MAX - 1)
/* General form of address family dependent message.
*/
struct nfgenmsg {
__u8 nfgen_family; /* AF_xxx */
__u8 version; /* nfnetlink version */
__be16 res_id; /* resource id */
};
#define NFNETLINK_V0 0
/* netfilter netlink message types are split in two pieces:
* 8 bit subsystem, 8bit operation.
*/
#define NFNL_SUBSYS_ID(x) ((x & 0xff00) >> 8)
#define NFNL_MSG_TYPE(x) (x & 0x00ff)
/* No enum here, otherwise __stringify() trick of MODULE_ALIAS_NFNL_SUBSYS()
* won't work anymore */
#define NFNL_SUBSYS_NONE 0
#define NFNL_SUBSYS_CTNETLINK 1
#define NFNL_SUBSYS_CTNETLINK_EXP 2
#define NFNL_SUBSYS_QUEUE 3
#define NFNL_SUBSYS_ULOG 4
#define NFNL_SUBSYS_OSF 5
#define NFNL_SUBSYS_IPSET 6
#define NFNL_SUBSYS_ACCT 7
#define NFNL_SUBSYS_CTNETLINK_TIMEOUT 8
#define NFNL_SUBSYS_COUNT 9
#ifdef __KERNEL__
#include <linux/netlink.h>
#include <linux/capability.h>
#include <net/netlink.h>
struct nfnl_callback {
int (*call)(struct sock *nl, struct sk_buff *skb,
const struct nlmsghdr *nlh,
const struct nlattr * const cda[]);
int (*call_rcu)(struct sock *nl, struct sk_buff *skb,
const struct nlmsghdr *nlh,
const struct nlattr * const cda[]);
const struct nla_policy *policy; /* netlink attribute policy */
const u_int16_t attr_count; /* number of nlattr's */
};
struct nfnetlink_subsystem {
const char *name;
__u8 subsys_id; /* nfnetlink subsystem ID */
__u8 cb_count; /* number of callbacks */
const struct nfnl_callback *cb; /* callback for individual types */
};
extern int nfnetlink_subsys_register(const struct nfnetlink_subsystem *n);
extern int nfnetlink_subsys_unregister(const struct nfnetlink_subsystem *n);
extern int nfnetlink_has_listeners(struct net *net, unsigned int group);
extern int nfnetlink_send(struct sk_buff *skb, struct net *net, u32 pid, unsigned group,
int echo, gfp_t flags);
extern int nfnetlink_set_err(struct net *net, u32 pid, u32 group, int error);
extern int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u_int32_t pid, int flags);
extern void nfnl_lock(void);
extern void nfnl_unlock(void);
#define MODULE_ALIAS_NFNL_SUBSYS(subsys) \
MODULE_ALIAS("nfnetlink-subsys-" __stringify(subsys))
#endif /* __KERNEL__ */
#endif /* _NFNETLINK_H */
libnetfilter_cttimeout-1.0.0/include/linux/netfilter/nfnetlink_cttimeout.h 0000644 0000000 0000000 00000005254 11760154031 0027306 0 ustar 00root root 0000000 0000000 #ifndef _CTTIMEOUT_NETLINK_H
#define _CTTIMEOUT_NETLINK_H
#include <linux/netfilter/nfnetlink.h>
enum ctnl_timeout_msg_types {
IPCTNL_MSG_TIMEOUT_NEW,
IPCTNL_MSG_TIMEOUT_GET,
IPCTNL_MSG_TIMEOUT_DELETE,
IPCTNL_MSG_TIMEOUT_MAX
};
enum ctattr_timeout {
CTA_TIMEOUT_UNSPEC,
CTA_TIMEOUT_NAME,
CTA_TIMEOUT_L3PROTO,
CTA_TIMEOUT_L4PROTO,
CTA_TIMEOUT_DATA,
CTA_TIMEOUT_USE,
__CTA_TIMEOUT_MAX
};
#define CTA_TIMEOUT_MAX (__CTA_TIMEOUT_MAX - 1)
enum ctattr_timeout_generic {
CTA_TIMEOUT_GENERIC_UNSPEC,
CTA_TIMEOUT_GENERIC_TIMEOUT,
__CTA_TIMEOUT_GENERIC_MAX
};
#define CTA_TIMEOUT_GENERIC_MAX (__CTA_TIMEOUT_GENERIC_MAX - 1)
enum ctattr_timeout_tcp {
CTA_TIMEOUT_TCP_UNSPEC,
CTA_TIMEOUT_TCP_SYN_SENT,
CTA_TIMEOUT_TCP_SYN_RECV,
CTA_TIMEOUT_TCP_ESTABLISHED,
CTA_TIMEOUT_TCP_FIN_WAIT,
CTA_TIMEOUT_TCP_CLOSE_WAIT,
CTA_TIMEOUT_TCP_LAST_ACK,
CTA_TIMEOUT_TCP_TIME_WAIT,
CTA_TIMEOUT_TCP_CLOSE,
CTA_TIMEOUT_TCP_SYN_SENT2,
CTA_TIMEOUT_TCP_RETRANS,
CTA_TIMEOUT_TCP_UNACK,
__CTA_TIMEOUT_TCP_MAX
};
#define CTA_TIMEOUT_TCP_MAX (__CTA_TIMEOUT_TCP_MAX - 1)
enum ctattr_timeout_udp {
CTA_TIMEOUT_UDP_UNSPEC,
CTA_TIMEOUT_UDP_UNREPLIED,
CTA_TIMEOUT_UDP_REPLIED,
__CTA_TIMEOUT_UDP_MAX
};
#define CTA_TIMEOUT_UDP_MAX (__CTA_TIMEOUT_UDP_MAX - 1)
enum ctattr_timeout_udplite {
CTA_TIMEOUT_UDPLITE_UNSPEC,
CTA_TIMEOUT_UDPLITE_UNREPLIED,
CTA_TIMEOUT_UDPLITE_REPLIED,
__CTA_TIMEOUT_UDPLITE_MAX
};
#define CTA_TIMEOUT_UDPLITE_MAX (__CTA_TIMEOUT_UDPLITE_MAX - 1)
enum ctattr_timeout_icmp {
CTA_TIMEOUT_ICMP_UNSPEC,
CTA_TIMEOUT_ICMP_TIMEOUT,
__CTA_TIMEOUT_ICMP_MAX
};
#define CTA_TIMEOUT_ICMP_MAX (__CTA_TIMEOUT_ICMP_MAX - 1)
enum ctattr_timeout_dccp {
CTA_TIMEOUT_DCCP_UNSPEC,
CTA_TIMEOUT_DCCP_REQUEST,
CTA_TIMEOUT_DCCP_RESPOND,
CTA_TIMEOUT_DCCP_PARTOPEN,
CTA_TIMEOUT_DCCP_OPEN,
CTA_TIMEOUT_DCCP_CLOSEREQ,
CTA_TIMEOUT_DCCP_CLOSING,
CTA_TIMEOUT_DCCP_TIMEWAIT,
__CTA_TIMEOUT_DCCP_MAX
};
#define CTA_TIMEOUT_DCCP_MAX (__CTA_TIMEOUT_DCCP_MAX - 1)
enum ctattr_timeout_sctp {
CTA_TIMEOUT_SCTP_UNSPEC,
CTA_TIMEOUT_SCTP_CLOSED,
CTA_TIMEOUT_SCTP_COOKIE_WAIT,
CTA_TIMEOUT_SCTP_COOKIE_ECHOED,
CTA_TIMEOUT_SCTP_ESTABLISHED,
CTA_TIMEOUT_SCTP_SHUTDOWN_SENT,
CTA_TIMEOUT_SCTP_SHUTDOWN_RECD,
CTA_TIMEOUT_SCTP_SHUTDOWN_ACK_SENT,
__CTA_TIMEOUT_SCTP_MAX
};
#define CTA_TIMEOUT_SCTP_MAX (__CTA_TIMEOUT_SCTP_MAX - 1)
enum ctattr_timeout_icmpv6 {
CTA_TIMEOUT_ICMPV6_UNSPEC,
CTA_TIMEOUT_ICMPV6_TIMEOUT,
__CTA_TIMEOUT_ICMPV6_MAX
};
#define CTA_TIMEOUT_ICMPV6_MAX (__CTA_TIMEOUT_ICMPV6_MAX - 1)
enum ctattr_timeout_gre {
CTA_TIMEOUT_GRE_UNSPEC,
CTA_TIMEOUT_GRE_UNREPLIED,
CTA_TIMEOUT_GRE_REPLIED,
__CTA_TIMEOUT_GRE_MAX
};
#define CTA_TIMEOUT_GRE_MAX (__CTA_TIMEOUT_GRE_MAX - 1)
#define CTNL_TIMEOUT_NAME_MAX 32
#endif
libnetfilter_cttimeout-1.0.0/libnetfilter_cttimeout.pc.in 0000644 0000000 0000000 00000000576 11760154031 0024005 0 ustar 00root root 0000000 0000000 # libnetfilter_cttimeout pkg-config file
prefix=@prefix@
exec_prefix=@exec_prefix@
libdir=@libdir@
includedir=@includedir@
Name: libnetfilter_cttimeout
Description: Netfilter extended cttimeout infrastructure library
URL: http://netfilter.org/projects/libnetfilter_cttimeout/
Version: @VERSION@
Requires:
Conflicts:
Libs: -L${libdir} -lnetfilter_cttimeout
Cflags: -I${includedir}
libnetfilter_cttimeout-1.0.0/m4/ 0000755 0000000 0000000 00000000000 11760154031 0016604 5 ustar 00root root 0000000 0000000 libnetfilter_cttimeout-1.0.0/m4/.gitignore 0000644 0000000 0000000 00000000024 11760154031 0020570 0 ustar 00root root 0000000 0000000 /libtool.m4
/lt*.m4
libnetfilter_cttimeout-1.0.0/m4/gcc4_visibility.m4 0000644 0000000 0000000 00000001150 11760154031 0022132 0 ustar 00root root 0000000 0000000
# GCC 4.x -fvisibility=hidden
AC_DEFUN([CHECK_GCC_FVISIBILITY], [
AC_LANG_PUSH([C])
saved_CFLAGS="$CFLAGS"
CFLAGS="$saved_CFLAGS -fvisibility=hidden"
AC_CACHE_CHECK([whether compiler accepts -fvisibility=hidden],
[ac_cv_fvisibility_hidden], AC_COMPILE_IFELSE(
[AC_LANG_SOURCE()],
[ac_cv_fvisibility_hidden=yes],
[ac_cv_fvisibility_hidden=no]
))
if test "$ac_cv_fvisibility_hidden" = "yes"; then
AC_DEFINE([HAVE_VISIBILITY_HIDDEN], [1],
[True if compiler supports -fvisibility=hidden])
AC_SUBST([GCC_FVISIBILITY_HIDDEN], [-fvisibility=hidden])
fi
CFLAGS="$saved_CFLAGS"
AC_LANG_POP([C])
])
libnetfilter_cttimeout-1.0.0/src/ 0000755 0000000 0000000 00000000000 11760154031 0017053 5 ustar 00root root 0000000 0000000 libnetfilter_cttimeout-1.0.0/src/Makefile.am 0000644 0000000 0000000 00000000565 11760154031 0021115 0 ustar 00root root 0000000 0000000 include $(top_srcdir)/Make_global.am
lib_LTLIBRARIES = libnetfilter_cttimeout.la
libnetfilter_cttimeout_la_LIBADD = ${LIBMNL_LIBS}
libnetfilter_cttimeout_la_LDFLAGS = -Wl,--version-script=$(srcdir)/libnetfilter_cttimeout.map -version-info $(LIBVERSION)
libnetfilter_cttimeout_la_SOURCES = libnetfilter_cttimeout.c \
libnetfilter_cttimeout.map \
internal.h
libnetfilter_cttimeout-1.0.0/src/internal.h 0000644 0000000 0000000 00000000363 11760154031 0021042 0 ustar 00root root 0000000 0000000 #ifndef INTERNAL_H
#define INTERNAL_H 1
#include "config.h"
#ifdef HAVE_VISIBILITY_HIDDEN
# define __visible __attribute__((visibility("default")))
# define EXPORT_SYMBOL(x) typeof(x) (x) __visible
#else
# define EXPORT_SYMBOL
#endif
#endif
libnetfilter_cttimeout-1.0.0/src/libnetfilter_cttimeout.c 0000644 0000000 0000000 00000044321 11760154031 0024003 0 ustar 00root root 0000000 0000000 /*
* (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published
* by the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This code has been sponsored by Vyatta Inc. <http://www.vyatta.com>
*/
#include "internal.h"
#include <time.h>
#include <endian.h>
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
#include <netinet/in.h>
#include <libmnl/libmnl.h>
#include <linux/netfilter/nfnetlink.h>
#include <linux/netfilter/nfnetlink_cttimeout.h>
#include <libnetfilter_cttimeout/libnetfilter_cttimeout.h>
static const char *const tcp_state_to_name[] = {
[NFCT_TIMEOUT_ATTR_TCP_SYN_SENT] = "SYN_SENT",
[NFCT_TIMEOUT_ATTR_TCP_SYN_RECV] = "SYN_RECV",
[NFCT_TIMEOUT_ATTR_TCP_ESTABLISHED] = "ESTABLISHED",
[NFCT_TIMEOUT_ATTR_TCP_FIN_WAIT] = "FIN_WAIT",
[NFCT_TIMEOUT_ATTR_TCP_CLOSE_WAIT] = "CLOSE_WAIT",
[NFCT_TIMEOUT_ATTR_TCP_LAST_ACK] = "LAST_ACK",
[NFCT_TIMEOUT_ATTR_TCP_TIME_WAIT] = "TIME_WAIT",
[NFCT_TIMEOUT_ATTR_TCP_CLOSE] = "CLOSE",
[NFCT_TIMEOUT_ATTR_TCP_SYN_SENT2] = "SYN_SENT2",
[NFCT_TIMEOUT_ATTR_TCP_RETRANS] = "RETRANS",
[NFCT_TIMEOUT_ATTR_TCP_UNACK] = "UNACKNOWLEDGED",
};
static const char *const generic_state_to_name[] = {
[NFCT_TIMEOUT_ATTR_GENERIC] = "TIMEOUT",
};
static const char *const udp_state_to_name[] = {
[NFCT_TIMEOUT_ATTR_UDP_UNREPLIED] = "UNREPLIED",
[NFCT_TIMEOUT_ATTR_UDP_REPLIED] = "REPLIED",
};
static const char *const sctp_state_to_name[] = {
[NFCT_TIMEOUT_ATTR_SCTP_CLOSED] = "CLOSED",
[NFCT_TIMEOUT_ATTR_SCTP_COOKIE_WAIT] = "COOKIE_WAIT",
[NFCT_TIMEOUT_ATTR_SCTP_COOKIE_ECHOED] = "COOKIE_ECHOED",
[NFCT_TIMEOUT_ATTR_SCTP_ESTABLISHED] = "ESTABLISHED",
[NFCT_TIMEOUT_ATTR_SCTP_SHUTDOWN_SENT] = "SHUTDOWN_SENT",
[NFCT_TIMEOUT_ATTR_SCTP_SHUTDOWN_RECD] = "SHUTDOWN_RECD",
[NFCT_TIMEOUT_ATTR_SCTP_SHUTDOWN_ACK_SENT] = "SHUTDOWN_ACK_SENT",
};
static const char *const dccp_state_to_name[] = {
[NFCT_TIMEOUT_ATTR_DCCP_REQUEST] = "REQUEST",
[NFCT_TIMEOUT_ATTR_DCCP_RESPOND] = "RESPOND",
[NFCT_TIMEOUT_ATTR_DCCP_PARTOPEN] = "PARTOPEN",
[NFCT_TIMEOUT_ATTR_DCCP_OPEN] = "OPEN",
[NFCT_TIMEOUT_ATTR_DCCP_CLOSEREQ] = "CLOSEREQ",
[NFCT_TIMEOUT_ATTR_DCCP_CLOSING] = "CLOSING",
[NFCT_TIMEOUT_ATTR_DCCP_TIMEWAIT] = "TIMEWAIT",
};
static const char *const icmp_state_to_name[] = {
[NFCT_TIMEOUT_ATTR_ICMP] = "TIMEOUT",
};
static const char *const icmpv6_state_to_name[] = {
[NFCT_TIMEOUT_ATTR_ICMPV6] = "TIMEOUT",
};
static struct {
uint32_t nlattr_max;
uint32_t attr_max;
const char *const *state_to_name;
} timeout_protocol[IPPROTO_MAX] = {
[IPPROTO_ICMP] = {
.nlattr_max = __CTA_TIMEOUT_ICMP_MAX,
.attr_max = NFCT_TIMEOUT_ATTR_ICMP_MAX,
.state_to_name = icmp_state_to_name,
},
[IPPROTO_TCP] = {
.nlattr_max = __CTA_TIMEOUT_TCP_MAX,
.attr_max = NFCT_TIMEOUT_ATTR_TCP_MAX,
.state_to_name = tcp_state_to_name,
},
[IPPROTO_UDP] = {
.nlattr_max = __CTA_TIMEOUT_UDP_MAX,
.attr_max = NFCT_TIMEOUT_ATTR_UDP_MAX,
.state_to_name = udp_state_to_name,
},
[IPPROTO_GRE] = {
.nlattr_max = __CTA_TIMEOUT_GRE_MAX,
.attr_max = NFCT_TIMEOUT_ATTR_GRE_MAX,
.state_to_name = udp_state_to_name,
},
[IPPROTO_SCTP] = {
.nlattr_max = __CTA_TIMEOUT_SCTP_MAX,
.attr_max = NFCT_TIMEOUT_ATTR_SCTP_MAX,
.state_to_name = sctp_state_to_name,
},
[IPPROTO_DCCP] = {
.nlattr_max = __CTA_TIMEOUT_DCCP_MAX,
.attr_max = NFCT_TIMEOUT_ATTR_DCCP_MAX,
.state_to_name = dccp_state_to_name,
},
[IPPROTO_UDPLITE] = {
.nlattr_max = __CTA_TIMEOUT_UDPLITE_MAX,
.attr_max = NFCT_TIMEOUT_ATTR_UDPLITE_MAX,
.state_to_name = udp_state_to_name,
},
[IPPROTO_ICMPV6] = {
.nlattr_max = __CTA_TIMEOUT_ICMPV6_MAX,
.attr_max = NFCT_TIMEOUT_ATTR_ICMPV6_MAX,
.state_to_name = icmpv6_state_to_name,
},
/* add your new supported protocol tracker here. */
[IPPROTO_RAW] = {
.nlattr_max = __CTA_TIMEOUT_GENERIC_MAX,
.attr_max = NFCT_TIMEOUT_ATTR_GENERIC_MAX,
.state_to_name = generic_state_to_name,
},
};
struct nfct_timeout {
char name[32]; /* object name. */
uint16_t l3num; /* AF_INET, ... */
uint8_t l4num; /* UDP, TCP, ... */
uint16_t attrset;
uint32_t *timeout; /* array of timeout. */
uint16_t polset;
};
/**
* \mainpage
*
* libnetfilter_cttimeout is the userspace library that provides a programming
* interface (API) to the in-kernel cttimeout infrastructure. This
* infrastructure allows you to define fine-grain connection tracking timeout
* policies that can be attached to traffic flows via iptables CT target.
* Before the existence of this infrastructure, you could only set global
* timeout policies per protocol. This library is currently used by the nfct
* utility that is part of the conntrack-tools.
*
* libnetfilter_cttimeout homepage is:
* http://netfilter.org/projects/libnetfilter_cttimeout/
*
* \section Dependencies
* libnetfilter_cttimeout requires libmnl and a kernel that includes the
* nfnetlink_cttimeout subsystem (i.e. 3.4.0 or later).
*
* \section Main Features
* - listing/retrieving entries from the timeout policy table.
* - inserting/modifying/deleting entries from the timeout policy table.
*
* \section Git Tree
* The current development version of libnetfilter_cttimeout can be accessed at
* https://git.netfilter.org/cgi-bin/gitweb.cgi?p=libnetfilter_cttimeout.git
*
* \section Privileges
* You need the CAP_NET_ADMIN capability in order to allow your application
* to receive events from and to send commands to kernel-space, excepting
* the timeout policy table dumping operation.
*
* \section Authors
* libnetfilter_conntrack has been written by Pablo Neira Ayuso.
*/
/**
* \defgroup nfcttimeout Timeout policy object handling
* @{
*/
/**
* nfct_timeout_alloc - allocate a new conntrack timeout object
* \param protonum layer 4 protocol number (use IPPROTO_* constants)
*
* You can use IPPROTO_MAX to set the timeout for the generic protocol tracker.
*
* In case of success, this function returns a valid pointer, otherwise NULL
* s returned and errno is appropriately set.
*/
struct nfct_timeout *nfct_timeout_alloc(void)
{
struct nfct_timeout *t;
t = calloc(1, sizeof(struct nfct_timeout));
if (t == NULL)
return NULL;
return t;
}
EXPORT_SYMBOL(nfct_timeout_alloc);
/**
* nfct_timeout_free - release one conntrack timeout object
* \param t pointer to the conntrack timeout object
*/
void nfct_timeout_free(struct nfct_timeout *t)
{
if (t->timeout)
free(t->timeout);
free(t);
}
EXPORT_SYMBOL(nfct_timeout_free);
/**
* nfct_timeout_attr_set - set one attribute of the conntrack timeout object
* \param t pointer to the conntrack timeout object
* \param type attribute type you want to set
* \param data pointer to data that will be used to set this attribute
*/
int
nfct_timeout_attr_set(struct nfct_timeout *t, uint32_t type, const void *data)
{
switch(type) {
case NFCT_TIMEOUT_ATTR_NAME:
strncpy(t->name, data, sizeof(t->name));
t->name[sizeof(t->name)-1] = '\0';
break;
case NFCT_TIMEOUT_ATTR_L3PROTO:
t->l3num = *((uint16_t *) data);
break;
case NFCT_TIMEOUT_ATTR_L4PROTO:
t->l4num = *((uint8_t *) data);
break;
/* NFCT_TIMEOUT_ATTR_POLICY is set by nfct_timeout_policy_attr_set. */
}
t->attrset |= (1 << type);
return 0;
}
EXPORT_SYMBOL(nfct_timeout_attr_set);
/**
* nfct_timeout_attr_set_u8 - set one attribute of the conntrack timeout object
* \param t pointer to the conntrack timeout object
* \param type attribute type you want to set
* \param data pointer to data that will be used to set this attribute
*/
int
nfct_timeout_attr_set_u8(struct nfct_timeout *t, uint32_t type, uint8_t data)
{
return nfct_timeout_attr_set(t, type, &data);
}
EXPORT_SYMBOL(nfct_timeout_attr_set_u8);
/**
* nfct_timeout_attr_set_u16 - set one attribute of the conntrack timeout object
* \param t pointer to the conntrack timeout object
* \param type attribute type you want to set
* \param data pointer to data that will be used to set this attribute
*/
int
nfct_timeout_attr_set_u16(struct nfct_timeout *t, uint32_t type, uint16_t data)
{
return nfct_timeout_attr_set(t, type, &data);
}
EXPORT_SYMBOL(nfct_timeout_attr_set_u16);
/**
* nfct_timeout_attr_unset - unset one attribute of the conntrack timeout object
* \param t pointer to the conntrack timeout object
* \param type attribute type you want to set
*/
void nfct_timeout_attr_unset(struct nfct_timeout *t, uint32_t type)
{
t->attrset &= ~(1 << type);
}
EXPORT_SYMBOL(nfct_timeout_attr_unset);
/**
* nfct_timeout_policy_attr_set_u32 - set one attribute of the policy
* \param t pointer to the conntrack timeout object
* \param type attribute type you want to set
* \param data data that will be used to set this attribute
*/
int
nfct_timeout_policy_attr_set_u32(struct nfct_timeout *t,
uint32_t type, uint32_t data)
{
size_t timeout_array_size;
/* Layer 4 protocol needs to be already set. */
if (!(t->attrset & (1 << NFCT_TIMEOUT_ATTR_L4PROTO)))
return -1;
if (t->timeout == NULL) {
/* if not supported, default to generic protocol tracker. */
if (timeout_protocol[t->l4num].attr_max != 0) {
timeout_array_size =
sizeof(uint32_t) *
timeout_protocol[t->l4num].attr_max;
} else {
timeout_array_size =
sizeof(uint32_t) *
timeout_protocol[IPPROTO_RAW].attr_max;
}
t->timeout = calloc(1, timeout_array_size);
if (t->timeout == NULL)
return -1;
}
/* this state does not exists in this protocol tracker. */
if (type > timeout_protocol[t->l4num].attr_max)
return -1;
t->timeout[type] = data;
t->polset |= (1 << type);
if (!(t->attrset & (1 << NFCT_TIMEOUT_ATTR_POLICY)))
t->attrset |= (1 << NFCT_TIMEOUT_ATTR_POLICY);
return 0;
}
EXPORT_SYMBOL(nfct_timeout_policy_attr_set_u32);
/**
* nfct_timeout_policy_attr_unset - unset one attribute of the policy
* \param t pointer to the conntrack timeout object
* \param type attribute type you want to set
*/
void nfct_timeout_policy_attr_unset(struct nfct_timeout *t, uint32_t type)
{
t->attrset &= ~(1 << type);
}
EXPORT_SYMBOL(nfct_timeout_policy_attr_unset);
/**
* nfct_timeout_policy_attr_to_name - get state name from protocol state number
* \param l4proto protocol, ie. IPPROTO_*
* \param state state number that you want to get the state name
*
* This function returns NULL if unsupported protocol or state number is passed.
* Otherwise, a pointer to valid string is returned.
*/
const char *nfct_timeout_policy_attr_to_name(uint8_t l4proto, uint32_t state)
{
if (timeout_protocol[l4proto].state_to_name == NULL) {
printf("no array state name\n");
return NULL;
}
if (timeout_protocol[l4proto].state_to_name[state] == NULL) {
printf("state %d does not exists\n", state);
return NULL;
}
return timeout_protocol[l4proto].state_to_name[state];
}
EXPORT_SYMBOL(nfct_timeout_policy_attr_to_name);
/**
* @}
*/
/**
* \defgroup nfcttimeout_output Timeout policy object output
* @{
*/
static int
nfct_timeout_snprintf_default(char *buf, size_t size,
const struct nfct_timeout *t,
unsigned int flags)
{
int ret = 0;
unsigned int offset = 0;
if (t->attrset & (1 << NFCT_TIMEOUT_ATTR_NAME)) {
ret = snprintf(buf+offset, size, ".%s = {\n", t->name);
offset += ret;
size -= ret;
}
if (t->attrset & (1 << NFCT_TIMEOUT_ATTR_L3PROTO)) {
ret = snprintf(buf+offset, size, "\t.l3proto = %u,\n",
t->l3num);
offset += ret;
size -= ret;
}
if (t->attrset & (1 << NFCT_TIMEOUT_ATTR_L4PROTO)) {
ret = snprintf(buf+offset, size, "\t.l4proto = %u,\n",
t->l4num);
offset += ret;
size -= ret;
}
if (t->attrset & (1 << NFCT_TIMEOUT_ATTR_POLICY)) {
uint8_t l4num = t->l4num;
int i;
/* default to generic protocol tracker. */
if (timeout_protocol[t->l4num].attr_max == 0)
l4num = IPPROTO_RAW;
ret = snprintf(buf+offset, size, "\t.policy = {\n");
offset += ret;
size -= ret;
for (i=0; i<timeout_protocol[l4num].attr_max; i++) {
const char *state_name =
timeout_protocol[l4num].state_to_name[i][0] ?
timeout_protocol[l4num].state_to_name[i] :
"UNKNOWN";
ret = snprintf(buf+offset, size,
"\t\t.%s = %u,\n", state_name, t->timeout[i]);
offset += ret;
size -= ret;
}
ret = snprintf(buf+offset, size, "\t},\n");
offset += ret;
size -= ret;
}
ret = snprintf(buf+offset, size, "};");
offset += ret;
size -= ret;
buf[offset]='\0';
return ret;
}
/**
* nfct_timeout_snprintf - print conntrack timeout object into one buffer
* \param buf: pointer to buffer that is used to print the object
* \param size: size of the buffer (or remaining room in it).
* \param t: pointer to a valid conntrack timeout object.
* \param type: output type (see NFCT_TIMEOUT_O_*)
* \param flags: output flags (always set this to zero).
*
* This function returns -1 in case that some mandatory attributes are
* missing. On sucess, it returns 0.
*/
int nfct_timeout_snprintf(char *buf, size_t size, const struct nfct_timeout *t,
unsigned int type, unsigned int flags)
{
int ret = 0;
switch(type) {
case NFCT_TIMEOUT_O_DEFAULT:
ret = nfct_timeout_snprintf_default(buf, size, t, flags);
break;
/* add your new output here. */
default:
break;
}
return ret;
}
EXPORT_SYMBOL(nfct_timeout_snprintf);
/**
* @}
*/
/**
* \defgroup nlmsg Netlink message helper functions
* @{
*/
/**
* nfct_timeout_nlmsg_build_hdr - build netlink message header for ct timeout
* \param buf: buffer where this function outputs the netlink message.
* \param cmd: nfct_timeout nfnetlink command.
* \param flags: netlink flags.
* \param seq: sequence number for this message.
*
* Possible commands:
* - CTNL_MSG_TIMEOUT_NEW: new conntrack timeout object.
* - CTNL_MSG_TIMEOUT_GET: get conntrack timeout object.
* - CTNL_MSG_TIMEOUT_DEL: delete conntrack timeout object.
*/
struct nlmsghdr *
nfct_timeout_nlmsg_build_hdr(char *buf, uint8_t cmd,
uint16_t flags, uint32_t seq)
{
struct nlmsghdr *nlh;
struct nfgenmsg *nfh;
nlh = mnl_nlmsg_put_header(buf);
nlh->nlmsg_type = (NFNL_SUBSYS_CTNETLINK_TIMEOUT << 8) | cmd;
nlh->nlmsg_flags = NLM_F_REQUEST | flags;
nlh->nlmsg_seq = seq;
nfh = mnl_nlmsg_put_extra_header(nlh, sizeof(struct nfgenmsg));
nfh->nfgen_family = AF_UNSPEC;
nfh->version = NFNETLINK_V0;
nfh->res_id = 0;
return nlh;
}
EXPORT_SYMBOL(nfct_timeout_nlmsg_build_hdr);
/**
* nfct_timeout_nlmsg_build_payload - build payload from ct timeout object
* \param nlh: netlink message that you want to use to add the payload.
* \param t: pointer to a conntrack timeout object
*/
void
nfct_timeout_nlmsg_build_payload(struct nlmsghdr *nlh,
const struct nfct_timeout *t)
{
int i;
struct nlattr *nest;
if (t->attrset & (1 << NFCT_TIMEOUT_ATTR_NAME))
mnl_attr_put_strz(nlh, CTA_TIMEOUT_NAME, t->name);
if (t->attrset & (1 << NFCT_TIMEOUT_ATTR_L3PROTO))
mnl_attr_put_u16(nlh, CTA_TIMEOUT_L3PROTO, htons(t->l3num));
if (t->attrset & (1 << NFCT_TIMEOUT_ATTR_L4PROTO))
mnl_attr_put_u8(nlh, CTA_TIMEOUT_L4PROTO, t->l4num);
if (t->attrset & (1 << NFCT_TIMEOUT_ATTR_POLICY) && t->polset) {
nest = mnl_attr_nest_start(nlh, CTA_TIMEOUT_DATA);
for (i=0; i<timeout_protocol[t->l4num].attr_max; i++) {
if (t->polset & (1 << i)) {
mnl_attr_put_u32(nlh, i+1,
htonl(t->timeout[i]));
}
}
mnl_attr_nest_end(nlh, nest);
}
}
EXPORT_SYMBOL(nfct_timeout_nlmsg_build_payload);
static int
timeout_nlmsg_parse_attr_cb(const struct nlattr *attr, void *data)
{
const struct nlattr **tb = data;
uint16_t type = mnl_attr_get_type(attr);
if (mnl_attr_type_valid(attr, CTA_TIMEOUT_MAX) < 0)
return MNL_CB_OK;
switch(type) {
case CTA_TIMEOUT_NAME:
if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0) {
perror("mnl_attr_validate");
return MNL_CB_ERROR;
}
break;
case CTA_TIMEOUT_L3PROTO:
if (mnl_attr_validate(attr, MNL_TYPE_U16) < 0) {
perror("mnl_attr_validate");
return MNL_CB_ERROR;
}
break;
case CTA_TIMEOUT_L4PROTO:
if (mnl_attr_validate(attr, MNL_TYPE_U8) < 0) {
perror("mnl_attr_validate");
return MNL_CB_ERROR;
}
break;
case CTA_TIMEOUT_DATA:
if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0) {
perror("mnl_attr_validate");
return MNL_CB_ERROR;
}
break;
}
tb[type] = attr;
return MNL_CB_OK;
}
struct _container_policy_cb {
unsigned int nlattr_max;
void *tb;
};
static int
parse_timeout_attr_policy_cb(const struct nlattr *attr, void *data)
{
struct _container_policy_cb *data_cb = data;
const struct nlattr **tb = data_cb->tb;
uint16_t type = mnl_attr_get_type(attr);
if (mnl_attr_type_valid(attr, data_cb->nlattr_max) < 0)
return MNL_CB_OK;
if (type <= data_cb->nlattr_max) {
if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) {
perror("mnl_attr_validate");
return MNL_CB_ERROR;
}
tb[type] = attr;
}
return MNL_CB_OK;
}
static void
timeout_parse_attr_data(struct nfct_timeout *t, const struct nlattr *nest)
{
unsigned int nlattr_max = timeout_protocol[t->l4num].nlattr_max;
struct nlattr *tb[nlattr_max];
struct _container_policy_cb cnt = {
.nlattr_max = nlattr_max,
.tb = tb,
};
unsigned int i;
memset(tb, 0, sizeof(struct nlattr *) * nlattr_max);
mnl_attr_parse_nested(nest, parse_timeout_attr_policy_cb, &cnt);
for (i=1; i<nlattr_max; i++) {
if (tb[i]) {
nfct_timeout_policy_attr_set_u32(t, i-1,
ntohl(mnl_attr_get_u32(tb[i])));
}
}
}
/**
* nfct_timeout_nlmsg_parse_payload - set timeout object attributes from message
* \param nlh: netlink message that you want to use to add the payload.
* \param t: pointer to a conntrack timeout object
*
* This function returns -1 in case that some mandatory attributes are
* missing. On sucess, it returns 0.
*/
int
nfct_timeout_nlmsg_parse_payload(const struct nlmsghdr *nlh,
struct nfct_timeout *t)
{
struct nlattr *tb[CTA_TIMEOUT_MAX+1] = {};
struct nfgenmsg *nfg = mnl_nlmsg_get_payload(nlh);
mnl_attr_parse(nlh, sizeof(*nfg), timeout_nlmsg_parse_attr_cb, tb);
if (tb[CTA_TIMEOUT_NAME]) {
nfct_timeout_attr_set(t, NFCT_TIMEOUT_ATTR_NAME,
mnl_attr_get_str(tb[CTA_TIMEOUT_NAME]));
}
if (tb[CTA_TIMEOUT_L3PROTO]) {
nfct_timeout_attr_set_u16(t, NFCT_TIMEOUT_ATTR_L3PROTO,
ntohs(mnl_attr_get_u16(tb[CTA_TIMEOUT_L3PROTO])));
}
if (tb[CTA_TIMEOUT_L4PROTO]) {
nfct_timeout_attr_set_u8(t, NFCT_TIMEOUT_ATTR_L4PROTO,
mnl_attr_get_u8(tb[CTA_TIMEOUT_L4PROTO]));
}
if (tb[CTA_TIMEOUT_DATA]) {
timeout_parse_attr_data(t, tb[CTA_TIMEOUT_DATA]);
}
return 0;
}
EXPORT_SYMBOL(nfct_timeout_nlmsg_parse_payload);
/**
* @}
*/
libnetfilter_cttimeout-1.0.0/src/libnetfilter_cttimeout.map 0000644 0000000 0000000 00000001227 11760154031 0024334 0 ustar 00root root 0000000 0000000 LIBNETFILTER_CTTIMEOUT_1.0 {
global:
nfct_timeout_alloc;
nfct_timeout_free;
nfct_timeout_attr_set;
nfct_timeout_attr_set_u8;
nfct_timeout_attr_set_u16;
nfct_timeout_attr_unset;
nfct_timeout_policy_attr_set_u32;
nfct_timeout_policy_unset;
nfct_timeout_policy_attr_to_name;
nfct_timeout_nlmsg_build_hdr;
nfct_timeout_nlmsg_build_payload;
nfct_timeout_nlmsg_parse_payload;
/* nfct_timeout_snprintf prototype was modified, new version in 1.1.
I decided not to keep the old symbol compatibility. See git log
for more information. */
local: *;
};
LIBNETFILTER_CTTIMEOUT_1.1 {
nfct_timeout_snprintf;
} LIBNETFILTER_CTTIMEOUT_1.0;