summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* api: add nfct_bitmask objectFlorian Westphal2013-05-065-0/+196
| | | | | | | | | | | | In order to use generic getter/setter API with upcoming conntrack label extension, add helper functions to set/test/unset bits in a vector of arbitrary size. Conntrack labels will then be encoded via nfct_bitmask object. Original idea from Pablo Neira Ayuso. Signed-off-by: Florian Westphal <fw@strlen.de>
* build: bump version to 1.0.3libnetfilter_conntrack-1.0.3Pablo Neira Ayuso2013-03-041-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* qa: add final OK message after checking release of clone objectsPablo Neira Ayuso2013-03-041-0/+2
| | | | | | For consistency with other tests. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* qa: fix bogus eror in test_apiPablo Neira Ayuso2013-03-041-2/+2
| | | | | | | | | | | | | Use buf[32] as struct nfct_attr_grp_ipv6 is 32 bytes long. That fixes: == validate set grp API == ERROR: set/get operations don't match for attribute 2 (2 != 1) ERROR: set/get operations don't match for attribute 3 (3 != 1) ERROR: set/get operations don't match for attribute 8 (8 != 1) Shows up with gcc 4.7.1. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Merge branch 'next' into libnetfilter_conntrack master branchPablo Neira Ayuso2013-01-231-0/+2
|\
| * refresh our public copy of nfnetlink_conntrack.hPablo Neira Ayuso2012-12-041-0/+2
| | | | | | | | | | | | To include: IPCTNL_MSG_CT_GET_DYING and IPCTNL_MSG_CT_GET_UNCONFIRMED Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | Fix logic typo in cmp_secctxThomas Jarosch2012-12-271-1/+1
|/ | | | | | | | cppcheck reported: [src/conntrack/compare.c:364] -> [src/conntrack/compare.c:364]: (style) Same expression on both sides of '||'. Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: fix nfct_clone with certain attribute data typesFlorian Westphal2012-11-284-8/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | some attributes are pointers to malloc'd objects. Simply copying the pointer results in use-after free when the original or the clone is destroyed. Fix it by using nfct_copy instead of memcpy and add proper test case for cloned objects: - nfct_cmp of orig and clone should return 1 (equal) - freeing both the original and the clone should neither leak memory nor result in double-frees. the testsuite changes revealed a few more problems: - ct1->timeout == ct2->timeout returned 0, ie. same timeout was considered "not equal" by nfct_cmp - secctx comparision causes "Invalid address" valgrind warnings when pointer is NULL - NFCT_CP_OVERRIDE did not handle helper attribute and erronously freed ct1 secctx memory. While at it, bump qa_test data dummy to 256 (else, valgrind complains about move-depends-on-uninitialized-memory). Lastly, fix compilation of test_api by killing bogus ATTR_CONNLABEL. Signed-off-by: Florian Westphal <fw@strlen.de>
* qa: fix handling of ATTR_HELPER_INFO attributeFlorian Westphal2012-11-221-3/+10
| | | | | | The attribute is variable-length and must be thus be set via set_attr_l(). Signed-off-by: Florian Westphal <fw@strlen.de>
* build: resolve automake-1.12 warningsJan Engelhardt2012-10-081-0/+1
| | | | | | | | | am/ltlibrary.am: warning: 'libnetfilter_conntrack.la': linking libtool libraries using a non-POSIX archiver requires 'AM_PROG_AR' in 'configure.ac' (multiple instances) Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* update LIBVERSIONlibnetfilter_conntrack-1.0.2Pablo Neira Ayuso2012-10-081-1/+1
| | | | | | | bump current and age since we have new interfaces but we're backward compatible. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* bump version to 1.0.2Pablo Neira Ayuso2012-10-081-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: add example that creates an expectation with NATPablo Neira Ayuso2012-09-112-0/+156
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: missing layer 3 protocol number in NAT informationPablo Neira Ayuso2012-09-111-0/+3
| | | | | | It was missing, add it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: fix compilation warning in nfexp_nlmsg_buildPablo Neira Ayuso2012-08-211-9/+0
| | | | | | | | | | build_mnl.c: In function 'nfexp_nlmsg_build': build_mnl.c:18:11: warning: variable 'l3num' set but not used [-Wunused-but-set-variable] This patch relaxes the checking for the L3PROTO. The kernel will report EINVAL in case that something is missing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix BPF code for IPv6 filtering in case of NFCT_FILTER_LOGIC_POSITIVEPablo Neira Ayuso2012-08-201-9/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 4b6df76 conntrack: fix autogenerated BPF code for IPv6 filtering aimed to fix a bug the IPv6 BPF filtering. However, it didn't fix it for NFCT_FILTER_LOGIC_POSITIVE case since jump is still miscalculated. This chunk below shows the BPF code to filter IPv6 address 2:4:6:: {0x00020004, 0x00060000, 0x0, 0x0 } in case that NFCT_FILTER_LOGIC_POSITIVE is used, ie. if that address matches, accept the event. (0032) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=00000004 (0033) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff (0034) code= BPF_JMP|BPF_JEQ|BPF_K jt=00 jf=09 k=00020004 [ this above compares second 4 bytes with 00020004, if comparison fails it jumps to 003e ] (0035) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=00000008 (0036) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff (0037) code= BPF_JMP|BPF_JEQ|BPF_K jt=00 jf=06 k=00060000 [ this above compares second 4 bytes with 00060000, if comparison fails it jumps to 003e ] (0038) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=0000000c (0039) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff (003a) code= BPF_JMP|BPF_JEQ|BPF_K jt=00 jf=03 k=00000000 [ this above compares third 4 bytes with 00000000, if comparison fails it jumps to 003e ] (003b) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=00000010 (003c) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff (003d) code= BPF_JMP|BPF_JEQ|BPF_K jt=01 jf=00 k=00000000 [ this above compares last 4 bytes with 00000000, if comparison succeded it jumps to 003f, which means, accept event ] (003e) code= BPF_RET|BPF_K jt=00 jf=00 k=00000000 ---- final verdict ---- (003f) code= BPF_RET|BPF_K jt=00 jf=00 k=ffffffff Just for the record: This chunk below shows the BPF code to filter IPv6 address 2:4:6:: {0x00020004, 0x00060000, 0x0, 0x0 } in case that NFCT_FILTER_LOGIC_NEGATIVE is used, ie. if that address matches, drop the event. [...] (0032) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=00000004 (0033) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff (0034) code= BPF_JMP|BPF_JEQ|BPF_K jt=00 jf=09 k=00020004 [ this above compares first 4 bytes with 00020004, if comparison fails it jumps to 003e ] (0035) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=00000008 (0036) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff (0037) code= BPF_JMP|BPF_JEQ|BPF_K jt=00 jf=06 k=00060000 [ this above compares second 4 bytes with 00060000, if comparison fails it jumps to 003e ] (0038) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=0000000c (0039) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff (003a) code= BPF_JMP|BPF_JEQ|BPF_K jt=00 jf=03 k=00000000 [ this above compares third 4 bytes with 00000000, if comparison fails it jumps to 003e ] (003b) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=00000010 (003c) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff (003d) code= BPF_JMP|BPF_JEQ|BPF_K jt=01 jf=00 k=00000000 [ this above compares last 4 bytes with 00000000, if comparison succeded it jumps to 003e ] (003e) code= BPF_JMP|BPF_JA jt=00 jf=00 k=00000001 (003f) code= BPF_RET|BPF_K jt=00 jf=00 k=00000000 [ default action specified by 003e is to drop the event ] Tested-by: Eric Leblond <eric@regit.org> Reported-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix autogenerated BPF code for IPv6 filteringPablo Neira Ayuso2012-07-251-9/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | BPF code generated for IPv6 filtering was wrong. Assuming you want to allow all traffic except ::1, the filter that libnetfilter_conntrack generates for the IPv6 address part looks like: [...] (0032) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=00000004 (0033) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff (0034) code= BPF_JMP|BPF_JEQ|BPF_K jt=00 jf=0a k=00000000 (0035) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=00000008 [0] (0036) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff [1] (0037) code= BPF_JMP|BPF_JEQ|BPF_K jt=00 jf=07 k=00000000 [2] (0038) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=0000000c [3] (0039) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff [4] (003a) code= BPF_JMP|BPF_JEQ|BPF_K jt=00 jf=04 k=00000000 [5] (003b) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=00000010 [6] (003c) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff [7] (003d) code= BPF_JMP|BPF_JEQ|BPF_K jt=01 jf=00 k=00000001 [8] (003e) code= BPF_JMP|BPF_JA jt=00 jf=00 k=00000001 [9] (003f) code= BPF_RET|BPF_K jt=00 jf=00 k=00000000 [A] Line 32 loads the first 4 bytes for the 32 bytes IPv6 address, then line 33 performs the binary AND with the first 4 bytes of the mask. Line 34 evaluated false for the case 2::1 that Eric reported (since 0x2 is not 0x0). Thus, jumping to line 3f that returns reject. However, 2::1 should be allowed. This false-jump case depends on the logic we're using, for the negative logic case, the jump offset is 9 to accept it. In the positive case (ie. accept this event message if matching happens), it has to be 10 (A), to reject it. Reported-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: more verbose debugging for BPF filter generationPablo Neira Ayuso2012-07-251-14/+86
| | | | | | | | | | | | This patch adds more verbose output for the automatic BPF filter generation to sieve netlink messages that are receive via ctnetlink. This code is disabled by default, only useful for debugging so far. It shouldn't be hard to provide a function to explicitly print instead. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: refresh linux_nfnetlink_conntrack.hPablo Neira Ayuso2012-06-271-0/+38
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add nfct_set_attr_l and ATTR_HELPER_INFOPablo Neira Ayuso2012-06-2610-73/+215
| | | | | | | | | | | | | | This adds the ATTR_HELPER_INFO that can be used to send binary data that will be attached to the conntrack. This is useful for the user-space connection tracking support. This patch also adds a new interface: nfct_set_attr_l(attr, type, value, length); that is used to set the variable length helper information. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: move library flags to CPPFLAGSJan Engelhardt2012-06-241-2/+2
| | | | | | | Because the obtained flags are essentially that (preprocessor options). Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* examples: add example using libmnl and the new low-level API (expectation)Pablo Neira Ayuso2012-05-263-1/+177
| | | | | | | | | | | | This patch adds the following examples: nfexp-mnl-dump nfexp-mnl-event Basically, we re-use the existing object oriented handling and we provide full control on the netlink socket at the same time. Signed-off-by: Pablo Neira Ayuso <pablo@gnumonks.org>
* examples: add example using libmnl and the new low-level API (conntrack)Pablo Neira Ayuso2012-05-269-2/+525
| | | | | | | | | | | | | | | | This patch adds the following examples: nfct-mnl-create nfct-mnl-del nfct-mnl-dump nfct-mnl-event nfct-mnl-flush nfct-mnl-get Basically, we re-use the existing object oriented handling and we provide full control on the netlink socket at the same time. Signed-off-by: Pablo Neira Ayuso <pablo@gnumonks.org>
* expect: add new API to build/parse ctnetlink messages using libmnlPablo Neira Ayuso2012-05-267-3/+167
| | | | | | | | This patch adds support to build and to parse netlink messages from/to one user-space nf_conntrack object. It uses libmnl, thus libnetfilter_conntrack now depends on this library. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add new API to build/parse ctnetlink messages using libmnlPablo Neira Ayuso2012-05-267-2/+1418
| | | | | | | | | | | | | | | This patch adds support to build and to parse netlink messages from/to one user-space nf_conntrack object. It uses libmnl, thus libnetfilter_conntrack now depends on this library. This is the first patch in the direction of removing the dependency on the veteran libnfnetlink. I have decided to update LIBVERSION in this patch. I know it's recommended to do this before releasing the software. I prefer to do this so snapshot packages get the correct LIBVERSION. Signed-off-by: Pablo Neira Ayuso <pablo@gnumonks.org>
* snprintf: print conntrack helper name, tooFlorian Westphal2012-05-202-0/+27
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* Update .gitignoreJan Engelhardt2012-05-192-0/+3
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: remove unused -DLIBNETFILTER_CONNTRACK_DIRJan Engelhardt2012-05-191-5/+0
| | | | | | | | CFLAGS must not be overriden if not set (it belongs to the user). Since -DLIBNETFILTER_CONNTRACK_DIR is unused however, remove it altogether. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* qa: change an if to elseifJan Engelhardt2012-05-191-1/+1
| | | | | | | The compiler is probably smart enough to see that the type cannot change, but make an "else" out of it, just for fun. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: remove unused LDFLAGSJan Engelhardt2012-05-192-24/+0
| | | | | | | "-ldl" is not needed since the programs themselves never use functions from libdl. Also, -dynamic is not required at all. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: bump version to 1.0.1libnetfilter_conntrack-1.0.1Pablo Neira Ayuso2012-05-182-2/+2
| | | | | | Also bump LIBVERSION. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: support NFCT_Q_CREATE_UPDATE in nfexp_queryKelvie Wong2012-05-071-0/+3
| | | | | | | | | This will work as it does in conntrack; it won't pass NLM_F_ACK into ctnetlink_new_expect in the kernel, and will thus invoke ctnetlink_change_expect if the expectation already exists. Signed-off-by: Kelvie Wong <kelvie@ieee.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* qa: add test case for get/set ATTR_GRP_* APIPablo Neira Ayuso2012-04-301-1/+66
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix new ATTR_GRP_[ORIG|REPL]_ADDR_[SRC|DST]Pablo Neira Ayuso2012-04-296-81/+125
| | | | | | | | | | The previous patch was incomplete. This fixes several issues with it like the IPV4 and IPV6 address are mutually exclusive, thus, the getter operation works. No sane way to support the setter operation correctly, thus, it's been documented that it has no effect. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add new ATTR_GRP_[ORIG|REPL]_ADDR_[SRC|DST] attributePablo Neira Ayuso2012-04-274-1/+87
| | | | | | | | | | | | | | | | | | | | This allows you to set and to get the address for both IPv4 and IPV6 using the same interface. This can simplify much redundant code that needs to support both protocols. This relies on some fixed layout union: union nfct_attr_grp_addr { u_int32_t ip; u_int32_t ip6[4]; u_int32_t addr[4]; }; But I don't see this library will support anything different from IPv4 and IPv6 as layer 3 protocol. If that happens and some point, we can add some new attribute group and deprecate this one. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix wrong building of ICMP reply tuplePablo Neira Ayuso2012-03-231-4/+1
| | | | | | | | | | | | For ICMP flows: conntrack -U -s 192.168.1.114 -m 1 returned -EINVAL. It seems we were including the reply tuple imcompletely. Reported-by: <abirvalg@lavabit.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* qa: several improvements for the ct_stress toolsPablo Neira Ayuso2012-03-122-9/+21
| | | | | | | | This patch improves several aspects of the QA tools to stress the conntrack system via ctnetlink and to check reliable event delivery. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* qa: add some stress tools to test conntrack via ctnetlinkPablo Neira Ayuso2012-03-063-1/+143
| | | | | | | | | | | | | | | | | | | | | ct_stress adds plenty of flows in assured state (worst case for the conntrack table). ct_events_reliable forces reliable event delivery. You have to use this tools together: ./ct_events_reliable & then: ./ct_stress 65535 # your ct table size If things go well, you will end up hitting ENOMEM. Both as root, of course. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add support for CTA_MARK_MASK and filtered dumpingPablo Neira Ayuso2012-02-0911-3/+238
| | | | | | | | This patch adds the infrastructure to allow filtered dumping. See utils/conntrack_dump_filter.c for instance. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: fix missing whitespace after expectation flags in nfexp_snprintfPablo Neira Ayuso2012-02-071-1/+5
| | | | | | | | | | | | | | Before: proto=17 src=192.168.11.4 dst=192.168.10.4 sport=0 dport=5060 mask-src=255.255.255.255 mask-dst=255.255.255.255 sport=0 dport=65535 master-src=192.168.10.4 master-dst=192.168.11.4 sport=5060 dport=5060 PERMANENTclass=0 helper=sip [active since 8s] After: proto=17 src=192.168.11.4 dst=192.168.10.4 sport=0 dport=5060 mask-src=255.255.255.255 mask-dst=255.255.255.255 sport=0 dport=65535 master-src=192.168.10.4 master-dst=192.168.11.4 sport=5060 dport=5060 PERMANENT class=0 helper=sip [active since 8s] Note the space after PERMANENT. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: fix comparison of expectation class and flagsPablo Neira Ayuso2012-02-071-4/+4
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: CTA_EXPECT_HELP_NAME must be NULL-terminatedPablo Neira Ayuso2012-02-061-1/+1
| | | | | | | Make sure this attribute is a NULL-terminated string, otherwise we hit EINVAL if we set this attribute. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: add expectfn supportPablo Neira Ayuso2012-02-067-0/+32
| | | | | | This patch allows you to set expectfn. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: add NAT supportPablo Neira Ayuso2012-02-067-0/+68
| | | | | | This patch adds ATTR_EXP_NAT_TUPLE and ATTR_EXP_NAT_DIR attributes. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: add class supportPablo Neira Ayuso2012-02-0610-0/+56
| | | | | | This patch allows you to specify the expectation class. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: add XML support for nfexp_snprintf()Pablo Neira Ayuso2012-01-226-40/+303
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Example of the XML output: <flow type="new"> <layer3 protonum="2" protoname="IPv4"> <expected> <src>192.168.0.2</src> <dst>192.168.1.2</dst> </expected> <mask> <src>255.255.255.255</src> <dst>255.255.255.255</dst> </mask> <master> <src>192.168.0.2</src> <dst>192.168.1.2</dst> </master> </layer3> <layer4 protonum="6" protoname="tcp"> <expected> <sport>0</sport> <dport>41739</dport> </expected> <mask> <sport>0</sport> <dport>65535</dport> </mask> <master> <sport>36390</sport> <dport>21</dport> </master> </layer4> <meta> <helper-name>ftp</helper-name> <timeout>300</timeout> <zone>0</zone> </meta> </flow> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: bump version to 1.0.0libnetfilter_conntrack-1.0.0Pablo Neira Ayuso2012-01-042-2/+2
| | | | | | This patch bumps version to 1.0.0 and it bumps the API revision number. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: add nfexp_cmpPablo Neira Ayuso2012-01-047-6/+126
| | | | | | | | | This patch adds nfexp_cmp that allows you to compare two expectation objects. This includes the extension of test_api for this new function. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: extend test_api for the expectation APIPablo Neira Ayuso2012-01-041-0/+52
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix set operation for master IPv6 src and dstPablo Neira Ayuso2012-01-041-2/+2
| | | | | | | | They seem to be accidentally swapped. Fix this. Spotted by qa/test_api. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>