diff options
Diffstat (limited to 'extensions')
-rw-r--r-- | extensions/libnetfilter_conntrack_icmp.c | 24 | ||||
-rw-r--r-- | extensions/libnetfilter_conntrack_sctp.c | 32 | ||||
-rw-r--r-- | extensions/libnetfilter_conntrack_tcp.c | 31 | ||||
-rw-r--r-- | extensions/libnetfilter_conntrack_udp.c | 32 |
4 files changed, 115 insertions, 4 deletions
diff --git a/extensions/libnetfilter_conntrack_icmp.c b/extensions/libnetfilter_conntrack_icmp.c index a6cfe77..a69f43d 100644 --- a/extensions/libnetfilter_conntrack_icmp.c +++ b/extensions/libnetfilter_conntrack_icmp.c @@ -15,6 +15,7 @@ #include <libnetfilter_conntrack/linux_nfnetlink_conntrack.h> #include <libnetfilter_conntrack/libnetfilter_conntrack.h> #include <libnetfilter_conntrack/libnetfilter_conntrack_extensions.h> +#include <libnetfilter_conntrack/libnetfilter_conntrack_icmp.h> static void parse_proto(struct nfattr *cda[], struct nfct_tuple *tuple) { @@ -51,12 +52,35 @@ static int print_proto(char *buf, struct nfct_tuple *t) ntohs(t->l4src.icmp.id))); } +static int compare(struct nfct_conntrack *ct1, + struct nfct_conntrack *ct2, + unsigned int flags) +{ + int ret = 1; + + if (flags & ICMP_TYPE) + if (ct1->tuple[NFCT_DIR_ORIGINAL].l4dst.icmp.type != + ct2->tuple[NFCT_DIR_ORIGINAL].l4dst.icmp.type) + ret = 0; + if (flags & ICMP_CODE) + if (ct1->tuple[NFCT_DIR_ORIGINAL].l4dst.icmp.code != + ct2->tuple[NFCT_DIR_ORIGINAL].l4dst.icmp.code) + ret = 0; + if (flags & ICMP_ID) + if (ct1->tuple[NFCT_DIR_REPLY].l4src.icmp.id != + ct2->tuple[NFCT_DIR_REPLY].l4src.icmp.id) + ret = 0; + + return ret; +} + static struct nfct_proto icmp = { .name = "icmp", .protonum = IPPROTO_ICMP, .parse_proto = parse_proto, .build_tuple_proto = build_tuple_proto, .print_proto = print_proto, + .compare = compare, .version = VERSION }; diff --git a/extensions/libnetfilter_conntrack_sctp.c b/extensions/libnetfilter_conntrack_sctp.c index 81a2467..aa06f6d 100644 --- a/extensions/libnetfilter_conntrack_sctp.c +++ b/extensions/libnetfilter_conntrack_sctp.c @@ -15,6 +15,7 @@ #include <libnetfilter_conntrack/linux_nfnetlink_conntrack.h> #include <libnetfilter_conntrack/libnetfilter_conntrack.h> #include <libnetfilter_conntrack/libnetfilter_conntrack_extensions.h> +#include <libnetfilter_conntrack/libnetfilter_conntrack_sctp.h> static void parse_proto(struct nfattr *cda[], struct nfct_tuple *tuple) { @@ -38,9 +39,9 @@ static void build_tuple_proto(struct nfnlhdr *req, int size, struct nfct_tuple *t) { nfnl_addattr_l(&req->nlh, size, CTA_PROTO_SRC_PORT, - &t->l4src.tcp.port, sizeof(u_int16_t)); + &t->l4src.sctp.port, sizeof(u_int16_t)); nfnl_addattr_l(&req->nlh, size, CTA_PROTO_DST_PORT, - &t->l4dst.tcp.port, sizeof(u_int16_t)); + &t->l4dst.sctp.port, sizeof(u_int16_t)); } static int print_protoinfo(char *buf, union nfct_protoinfo *protoinfo) @@ -55,6 +56,32 @@ static int print_proto(char *buf, struct nfct_tuple *tuple) htons(tuple->l4dst.sctp.port))); } +static int compare(struct nfct_conntrack *ct1, + struct nfct_conntrack *ct2, + unsigned int flags) +{ + int ret = 1; + + if (flags & SCTP_ORIG_SPORT) + if (ct1->tuple[NFCT_DIR_ORIGINAL].l4src.sctp.port != + ct2->tuple[NFCT_DIR_ORIGINAL].l4src.sctp.port) + ret = 0; + if (flags & SCTP_ORIG_DPORT) + if (ct1->tuple[NFCT_DIR_ORIGINAL].l4dst.sctp.port != + ct2->tuple[NFCT_DIR_ORIGINAL].l4dst.sctp.port) + ret = 0; + if (flags & SCTP_REPL_SPORT) + if (ct1->tuple[NFCT_DIR_REPLY].l4src.sctp.port != + ct2->tuple[NFCT_DIR_REPLY].l4src.sctp.port) + ret = 0; + if (flags & SCTP_REPL_DPORT) + if (ct1->tuple[NFCT_DIR_REPLY].l4dst.sctp.port != + ct2->tuple[NFCT_DIR_REPLY].l4dst.sctp.port) + ret = 0; + + return ret; +} + static struct nfct_proto sctp = { .name = "sctp", .protonum = IPPROTO_SCTP, @@ -63,6 +90,7 @@ static struct nfct_proto sctp = { .build_tuple_proto = build_tuple_proto, .print_proto = print_proto, .print_protoinfo = print_protoinfo, + .compare = compare, .version = VERSION }; diff --git a/extensions/libnetfilter_conntrack_tcp.c b/extensions/libnetfilter_conntrack_tcp.c index 95503ec..dc50315 100644 --- a/extensions/libnetfilter_conntrack_tcp.c +++ b/extensions/libnetfilter_conntrack_tcp.c @@ -15,6 +15,7 @@ #include <libnetfilter_conntrack/linux_nfnetlink_conntrack.h> #include <libnetfilter_conntrack/libnetfilter_conntrack.h> #include <libnetfilter_conntrack/libnetfilter_conntrack_extensions.h> +#include <libnetfilter_conntrack/libnetfilter_conntrack_tcp.h> static const char *states[] = { "NONE", @@ -93,6 +94,35 @@ static int print_proto(char *buf, struct nfct_tuple *tuple) htons(tuple->l4dst.tcp.port))); } +static int compare(struct nfct_conntrack *ct1, + struct nfct_conntrack *ct2, + unsigned int flags) +{ + int ret = 1; + + if (flags & TCP_ORIG_SPORT) + if (ct1->tuple[NFCT_DIR_ORIGINAL].l4src.tcp.port != + ct2->tuple[NFCT_DIR_ORIGINAL].l4src.tcp.port) + ret = 0; + if (flags & TCP_ORIG_DPORT) + if (ct1->tuple[NFCT_DIR_ORIGINAL].l4dst.tcp.port != + ct2->tuple[NFCT_DIR_ORIGINAL].l4dst.tcp.port) + ret = 0; + if (flags & TCP_REPL_SPORT) + if (ct1->tuple[NFCT_DIR_REPLY].l4src.tcp.port != + ct2->tuple[NFCT_DIR_REPLY].l4src.tcp.port) + ret = 0; + if (flags & TCP_REPL_DPORT) + if (ct1->tuple[NFCT_DIR_REPLY].l4dst.tcp.port != + ct2->tuple[NFCT_DIR_REPLY].l4dst.tcp.port) + ret = 0; + if (flags & TCP_STATE) + if (ct1->protoinfo.tcp.state != ct2->protoinfo.tcp.state) + ret = 0; + + return ret; +} + static struct nfct_proto tcp = { .name = "tcp", .protonum = IPPROTO_TCP, @@ -102,6 +132,7 @@ static struct nfct_proto tcp = { .build_protoinfo = build_protoinfo, .print_protoinfo = print_protoinfo, .print_proto = print_proto, + .compare = compare, .version = VERSION }; diff --git a/extensions/libnetfilter_conntrack_udp.c b/extensions/libnetfilter_conntrack_udp.c index 21c599a..bd33280 100644 --- a/extensions/libnetfilter_conntrack_udp.c +++ b/extensions/libnetfilter_conntrack_udp.c @@ -15,6 +15,7 @@ #include <libnetfilter_conntrack/linux_nfnetlink_conntrack.h> #include <libnetfilter_conntrack/libnetfilter_conntrack.h> #include <libnetfilter_conntrack/libnetfilter_conntrack_extensions.h> +#include <libnetfilter_conntrack/libnetfilter_conntrack_udp.h> static void parse_proto(struct nfattr *cda[], struct nfct_tuple *tuple) { @@ -36,9 +37,35 @@ static void build_tuple_proto(struct nfnlhdr *req, int size, struct nfct_tuple *t) { nfnl_addattr_l(&req->nlh, size, CTA_PROTO_SRC_PORT, - &t->l4src.tcp.port, sizeof(u_int16_t)); + &t->l4src.udp.port, sizeof(u_int16_t)); nfnl_addattr_l(&req->nlh, size, CTA_PROTO_DST_PORT, - &t->l4dst.tcp.port, sizeof(u_int16_t)); + &t->l4dst.udp.port, sizeof(u_int16_t)); +} + +static int compare(struct nfct_conntrack *ct1, + struct nfct_conntrack *ct2, + unsigned int flags) +{ + int ret = 1; + + if (flags & UDP_ORIG_SPORT) + if (ct1->tuple[NFCT_DIR_ORIGINAL].l4src.udp.port != + ct2->tuple[NFCT_DIR_ORIGINAL].l4src.udp.port) + ret = 0; + if (flags & UDP_ORIG_DPORT) + if (ct1->tuple[NFCT_DIR_ORIGINAL].l4dst.udp.port != + ct2->tuple[NFCT_DIR_ORIGINAL].l4dst.udp.port) + ret = 0; + if (flags & UDP_REPL_SPORT) + if (ct1->tuple[NFCT_DIR_REPLY].l4src.udp.port != + ct2->tuple[NFCT_DIR_REPLY].l4src.udp.port) + ret = 0; + if (flags & UDP_REPL_DPORT) + if (ct1->tuple[NFCT_DIR_REPLY].l4dst.udp.port != + ct2->tuple[NFCT_DIR_REPLY].l4dst.udp.port) + ret = 0; + + return ret; } static struct nfct_proto udp = { @@ -47,6 +74,7 @@ static struct nfct_proto udp = { .build_tuple_proto = build_tuple_proto, .parse_proto = parse_proto, .print_proto = print_proto, + .compare = compare, .version = VERSION, }; |