summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* expect: parse_mnl: fix gcc compile warningPablo Neira Ayuso2020-04-011-0/+1
| | | | | | | | | | | | | parse_mnl.c: In function ‘nfexp_nlmsg_parse’: parse_mnl.c:142:3: warning: ‘strncpy’ specified bound 16 equals destination size [-Wstringop-truncation] 142 | strncpy(exp->helper_name, | ^~~~~~~~~~~~~~~~~~~~~~~~~ 143 | mnl_attr_get_str(tb[CTA_EXPECT_HELP_NAME]), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 144 | NFCT_HELPER_NAME_MAX); | ~~~~~~~~~~~~~~~~~~~~~ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: support for IPS_OFFLOADPablo Neira Ayuso2019-08-091-2/+4
| | | | | | Print [OFFLOAD] tag when listing entries via snprintf() interface. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: api: use libmnl API to build the netlink headersPablo Neira Ayuso2019-05-032-7/+51
| | | | | | Replace libnfnetlink's nfnl_fill_hdr() by more modern libmnl code. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: replace old libnfnetlink builderPablo Neira Ayuso2019-05-022-665/+28
| | | | | | Use the new libmnl version, remove duplicated code. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: replace old libnfnetlink parserPablo Neira Ayuso2019-05-027-775/+45
| | | | | | Use the new libmnl version, remove duplicated code. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: add missing handling for CTA_EXPECT_* attributesPablo Neira Ayuso2019-05-021-3/+61
| | | | | | | Add missing code to handle CTA_EXPECT_CLASS, CTA_EXPECT_NAT and CTA_EXPECT_FN from libmnl parser. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce abi_breakage()Pablo Neira Ayuso2019-05-023-29/+35
| | | | | | | | | Changes in the netlink attribute layout is considered to be a kernel ABI breakage, so report this immediately and stop execution, instead of lazy error back to the client application, which cannot do anything with this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add synproxy supportPablo Neira Ayuso2018-03-247-0/+179
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* labels: don't crash on NULL labelmapMarcos Paulo de Souza2017-07-251-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | When CONNLABEL_CFG isn't available (/etc/xtables/connlabel.conf), conntrack tool crashes: [marcos@Icarus ~]$ conntrack -l something nfct_labelmap_new: No such file or directory Segmentation fault (core dumped) I can see this problem in Fedora 26, because connlabel.conf does not come along the conntrack/libnetfilter packages. This problem happens because conntrack calls nfct_labelmap_new, which resides on libnetfilter_conntrack. So this lib returns NULL because CONNLABEL_CFG is not present, and then NULL is assigned to the global var called labelmap on conntrack. Later, get_label is called, passing NULL to the library, and __label_get_bit is called and deferences labelmap without check, which leads to a crash. With this patch the crash does not happen anymore, and an error message is displayed: conntrack -l something nfct_labelmap_new: No such file or directory conntrack v1.4.4 (conntrack-tools): unknown label 'something' Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: revert getobjopt_is_nat() conditionKen-ichirou MATSUZAWA2017-03-031-8/+4
| | | | | | | | | | getobjopt_is_nat() used to work even if no status bits where set, by checking if addresses don't match. Restore this behaviour for compatibility reasons. Fixes: 73ad642ba462 ("src: add support for IPv6 NAT") Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix missing break in setobjopt_undo_dnat()Ken-ichirou MATSUZAWA2017-02-281-0/+1
| | | | | | | Otherwise we fall into the IPv6 case. Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Make the library compile under clangKevin Cernekee2016-08-172-4/+4
| | | | | | | | | | | | clang treats "char buffer[size]" inside a union as VLAIS unless |size| is const: src/conntrack/api.c:992:8: error: fields must have a constant size: 'variable length array in structure' extension will never be supported char buffer[size]; ^ Signed-off-by: Kevin Cernekee <cernekee@chromium.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: labels: add function to fetch default config file locationFlorian Westphal2016-08-082-0/+16
| | | | | | Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support for IPv6 NATArturo Borrero2016-05-206-2/+148
| | | | | | | | | | The conntrackd daemon lacks support for syncing IPv6 NATed connections. This patch adds support for managing the IPv6 part of struct __nfct_nat, also updating the corresponsing symbols. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support for IPv6 to struct __nfct_natArturo Borrero2016-05-206-44/+89
| | | | | | | | | | | | The conntrackd daemon lacks support for syncing IPv6 NATed connections. This patch prepares the ground to give support to such operations: * replace uint32_t with union __nfct_address in struct __nfct_nat. * update all users of the former uint32_t to support the new struct A follow-up patch gives support to actually manage the IPv6 NAT. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* setter: don't touch snat.max_ip in set_attr_dnat_ipv4Florian Westphal2016-01-121-1/+1
| | | | | | | looks like copy & paste bug. Reported-by: Sargun Dhillon <sargun@sargun.me> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: add zone attribute to tupleDaniel Borkmann2015-09-2910-20/+198
| | | | | | | | This patch adds the front-end to the recent ctnetlink interface changes that add the zone attribute into the tuple. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix stop timestamp assignmentKen-ichirou MATSUZAWA2015-07-071-1/+1
| | | | | Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: Use stdint types everywhereFelix Janda2015-05-2517-216/+216
| | | | | Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add mark event filterKen-ichirou MATSUZAWA2015-03-132-0/+86
| | | | | | | | This patch adds mark filter for event listener, using same struct nfct_filter_dump_mark at dump. Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Florian Westphal <fw@strlen.de>
* src/Makefile.am: drop hardcoded -ldlGustavo Zacarias2015-01-211-1/+1
| | | | | | | This breaks static builds where the toolchain completely lacks libdl. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: fix symbol name typo in commentKen-ichirou MATSUZAWA2014-10-081-3/+3
| | | | | Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: api: add two new bitmask functionsKen-ichirou MATSUZAWA2014-09-111-0/+29
| | | | | | | | This patch adds two functions, useful for ulogd IPFIX output module. Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: compare: relax MARK/ZONE attribute comparisionFlorian Westphal2014-06-241-42/+45
| | | | | | | | | | | | | | | | Relax checking for MARK and ZONE to treat 'attribute not set' like 'attribute is set to 0'. This matches kernel behaviour, conntracks are always in zone 0, except if specified differently. Same for connmark. The kernel will also not include the zone/mark attributes in dumps unless they have non-zero values. This makes qa/test_api pass again with the updated test cases. Reported-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: remove duplicate codeKen-ichirou MATSUZAWA2014-06-211-2/+0
| | | | | | | nfct_filter_dump_set_attr() will set the bit. Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: labels: remove dead codeFlorian Westphal2014-02-181-1/+1
| | | | | | unsigned, < 0 is always false. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: fix documentation regarding nfct_catch() and nfexp_catch()Pablo Neira Ayuso2014-01-302-4/+16
| | | | | | | | Stefan reported that the *_catch() functions documentation was imprecise on some aspects. Reported-by: Stefan Nicolae Stancu <Stefan.Stancu@cern.ch> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: mnl: fix parsing payload lenKen-ichirou MATSUZAWA2014-01-291-1/+2
| | | | | | | | Substract the netlink + nfnetlink headers to pass the payload length to nfct_payload_parse(). Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: labels: labelmap_new: make sure errno is 0 when no labels are foundFlorian Westphal2013-07-111-1/+3
| | | | | | | | | | | | | | nfct_labelmap_new returns NULL on failure, e.g. when file cannot be opened. It will also fail if no labels have been parsed, and in this case, content of errno is random. Avoid it by making sure that errno is re-set when no labels were found. While at it, also change ptr test when parsing so reviewers don't need to triple check that this cannot result in out-of-bounds read. Reported-by: Afschin Hormozdiary <Afschin.Hormozdiary@sophos.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: api: add nfct_snprintf_labelsFlorian Westphal2013-07-044-7/+118
| | | | | | | | | | | | | | | | | | | | nfct_snprintf doesn't print connlabels, as they're system specific and can easily generate lots of output. This adds a new helper function, nfct_snprintf_labels. It behaves like nfct_snprintf, except that the label names in the labelmap whose bits are contained in connlabel attribute bitset are added to the buffer. output looks like this: output looks like this: ... mark=0 use=1 labels=eth0-in,eth1-in or <labels> <label>eth0-in</label> <label>eth1-in</label> </labels> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: callback: fix memory leak when ct has dynamically allocated attrFlorian Westphal2013-07-031-26/+8
| | | | | | Must free ct and exp using the _destroy functions, else we leak attributes with malloc'd data. Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: labels: skip labels with non-alnum charactersFlorian Westphal2013-06-301-1/+27
| | | | | | | | | | | | Can always lift this restriction later but for now enforce strict label naming. This is mainly to make sure that e.g. using conntrack ... -o xml,connlabels will output the expected format, without nasty surprises. Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: connlabel: remove useless testFlorian Westphal2013-06-181-2/+2
| | | | | | Can't be zero, it was already tested. Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: CONNLABELS are not a nested attributeFlorian Westphal2013-06-181-9/+5
| | | | | | | This fixes construction of the conntrack object when CTA_LABEL attribute is present. Signed-off-by: Florian Westphal <fw@strlen.de>
* connlabel: fix NULL deref on malloc failureFlorian Westphal2013-06-061-1/+1
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: nfct_cmp: also compare labelsFlorian Westphal2013-06-051-0/+49
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* expect: consider all expect attributes when comparingFlorian Westphal2013-06-051-10/+78
| | | | | | The expect cmp function ignored most of the attributes. Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack, expect: fix _cmp api with STRICT checkingFlorian Westphal2013-06-022-2/+11
| | | | | | | | | | | | | Normal comparision succeeds when the _common_ attribute subset have same values. When STRICT matching is specified, the comparision should succeed only when both objects have same attribute subset and attribute values match. However, STRICT comparision often fails as an attribute missing in both objects is erronously considered an error. Signed-off-by: Florian Westphal <fw@strlen.de>
* libnetfilter_conntrack: don't ignore ATTR_CONNLABELSAfschin Hormozdiary2013-05-202-0/+51
| | | | | | | | | | | | | | The libnfnetlink based backend 'build.c' currently ignores ATTR_CONNLABELS and ATTR_CONNLABELS_MASK. The libmnl based backend 'build_mnl.c' instead handles both attributes correct. Add function to set CTA_LABELS and CTA_LABELS_MASK if required. Signed-off-by: Afschin Hormozdiary <Afschin.Hormozdiary@sophos.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* api: add CTA_LABEL_MASK attribute handlingFlorian Westphal2013-05-066-5/+40
| | | | | | | allows to set/clear only a subset of the in-kernel label set, e.g. "set bit 1 and do not change any others". Signed-off-by: Florian Westphal <fw@strlen.de>
* api: add connlabel api and attributeFlorian Westphal2013-05-069-2/+392
| | | | | | | | | | | | | | | | | | | | | | adds new labelmap api to create a name <-> bit mapping from a text file (default: /etc/xtables/connlabel.conf). nfct_labelmap_new(filename) is used to create the map, nfct_labelmap_destroy() releases the resources allocated for the map. Two functions are added to make map lookups: nfct_labelmap_get_name(map, bit) returns the name of a bit, nfct_labelmap_get_bit returns the bit associated with a name. The connlabel attribute is represented by a nfct_bitmask object, the nfct_bitmask api can be used to test/set/get individual bits ("labels"). The exisiting nfct_attr_get/set interfaces can be used to read or replace the existing labels associated with a conntrack with a new set. Signed-off-by: Florian Westphal <fw@strlen.de>
* api: add nfct_bitmask objectFlorian Westphal2013-05-061-0/+119
| | | | | | | | | | | | In order to use generic getter/setter API with upcoming conntrack label extension, add helper functions to set/test/unset bits in a vector of arbitrary size. Conntrack labels will then be encoded via nfct_bitmask object. Original idea from Pablo Neira Ayuso. Signed-off-by: Florian Westphal <fw@strlen.de>
* Fix logic typo in cmp_secctxThomas Jarosch2012-12-271-1/+1
| | | | | | | | cppcheck reported: [src/conntrack/compare.c:364] -> [src/conntrack/compare.c:364]: (style) Same expression on both sides of '||'. Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: fix nfct_clone with certain attribute data typesFlorian Westphal2012-11-283-6/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | some attributes are pointers to malloc'd objects. Simply copying the pointer results in use-after free when the original or the clone is destroyed. Fix it by using nfct_copy instead of memcpy and add proper test case for cloned objects: - nfct_cmp of orig and clone should return 1 (equal) - freeing both the original and the clone should neither leak memory nor result in double-frees. the testsuite changes revealed a few more problems: - ct1->timeout == ct2->timeout returned 0, ie. same timeout was considered "not equal" by nfct_cmp - secctx comparision causes "Invalid address" valgrind warnings when pointer is NULL - NFCT_CP_OVERRIDE did not handle helper attribute and erronously freed ct1 secctx memory. While at it, bump qa_test data dummy to 256 (else, valgrind complains about move-depends-on-uninitialized-memory). Lastly, fix compilation of test_api by killing bogus ATTR_CONNLABEL. Signed-off-by: Florian Westphal <fw@strlen.de>
* expect: missing layer 3 protocol number in NAT informationPablo Neira Ayuso2012-09-111-0/+3
| | | | | | It was missing, add it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: fix compilation warning in nfexp_nlmsg_buildPablo Neira Ayuso2012-08-211-9/+0
| | | | | | | | | | build_mnl.c: In function 'nfexp_nlmsg_build': build_mnl.c:18:11: warning: variable 'l3num' set but not used [-Wunused-but-set-variable] This patch relaxes the checking for the L3PROTO. The kernel will report EINVAL in case that something is missing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix BPF code for IPv6 filtering in case of NFCT_FILTER_LOGIC_POSITIVEPablo Neira Ayuso2012-08-201-9/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 4b6df76 conntrack: fix autogenerated BPF code for IPv6 filtering aimed to fix a bug the IPv6 BPF filtering. However, it didn't fix it for NFCT_FILTER_LOGIC_POSITIVE case since jump is still miscalculated. This chunk below shows the BPF code to filter IPv6 address 2:4:6:: {0x00020004, 0x00060000, 0x0, 0x0 } in case that NFCT_FILTER_LOGIC_POSITIVE is used, ie. if that address matches, accept the event. (0032) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=00000004 (0033) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff (0034) code= BPF_JMP|BPF_JEQ|BPF_K jt=00 jf=09 k=00020004 [ this above compares second 4 bytes with 00020004, if comparison fails it jumps to 003e ] (0035) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=00000008 (0036) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff (0037) code= BPF_JMP|BPF_JEQ|BPF_K jt=00 jf=06 k=00060000 [ this above compares second 4 bytes with 00060000, if comparison fails it jumps to 003e ] (0038) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=0000000c (0039) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff (003a) code= BPF_JMP|BPF_JEQ|BPF_K jt=00 jf=03 k=00000000 [ this above compares third 4 bytes with 00000000, if comparison fails it jumps to 003e ] (003b) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=00000010 (003c) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff (003d) code= BPF_JMP|BPF_JEQ|BPF_K jt=01 jf=00 k=00000000 [ this above compares last 4 bytes with 00000000, if comparison succeded it jumps to 003f, which means, accept event ] (003e) code= BPF_RET|BPF_K jt=00 jf=00 k=00000000 ---- final verdict ---- (003f) code= BPF_RET|BPF_K jt=00 jf=00 k=ffffffff Just for the record: This chunk below shows the BPF code to filter IPv6 address 2:4:6:: {0x00020004, 0x00060000, 0x0, 0x0 } in case that NFCT_FILTER_LOGIC_NEGATIVE is used, ie. if that address matches, drop the event. [...] (0032) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=00000004 (0033) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff (0034) code= BPF_JMP|BPF_JEQ|BPF_K jt=00 jf=09 k=00020004 [ this above compares first 4 bytes with 00020004, if comparison fails it jumps to 003e ] (0035) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=00000008 (0036) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff (0037) code= BPF_JMP|BPF_JEQ|BPF_K jt=00 jf=06 k=00060000 [ this above compares second 4 bytes with 00060000, if comparison fails it jumps to 003e ] (0038) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=0000000c (0039) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff (003a) code= BPF_JMP|BPF_JEQ|BPF_K jt=00 jf=03 k=00000000 [ this above compares third 4 bytes with 00000000, if comparison fails it jumps to 003e ] (003b) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=00000010 (003c) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff (003d) code= BPF_JMP|BPF_JEQ|BPF_K jt=01 jf=00 k=00000000 [ this above compares last 4 bytes with 00000000, if comparison succeded it jumps to 003e ] (003e) code= BPF_JMP|BPF_JA jt=00 jf=00 k=00000001 (003f) code= BPF_RET|BPF_K jt=00 jf=00 k=00000000 [ default action specified by 003e is to drop the event ] Tested-by: Eric Leblond <eric@regit.org> Reported-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix autogenerated BPF code for IPv6 filteringPablo Neira Ayuso2012-07-251-9/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | BPF code generated for IPv6 filtering was wrong. Assuming you want to allow all traffic except ::1, the filter that libnetfilter_conntrack generates for the IPv6 address part looks like: [...] (0032) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=00000004 (0033) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff (0034) code= BPF_JMP|BPF_JEQ|BPF_K jt=00 jf=0a k=00000000 (0035) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=00000008 [0] (0036) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff [1] (0037) code= BPF_JMP|BPF_JEQ|BPF_K jt=00 jf=07 k=00000000 [2] (0038) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=0000000c [3] (0039) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff [4] (003a) code= BPF_JMP|BPF_JEQ|BPF_K jt=00 jf=04 k=00000000 [5] (003b) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=00000010 [6] (003c) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff [7] (003d) code= BPF_JMP|BPF_JEQ|BPF_K jt=01 jf=00 k=00000001 [8] (003e) code= BPF_JMP|BPF_JA jt=00 jf=00 k=00000001 [9] (003f) code= BPF_RET|BPF_K jt=00 jf=00 k=00000000 [A] Line 32 loads the first 4 bytes for the 32 bytes IPv6 address, then line 33 performs the binary AND with the first 4 bytes of the mask. Line 34 evaluated false for the case 2::1 that Eric reported (since 0x2 is not 0x0). Thus, jumping to line 3f that returns reject. However, 2::1 should be allowed. This false-jump case depends on the logic we're using, for the negative logic case, the jump offset is 9 to accept it. In the positive case (ie. accept this event message if matching happens), it has to be 10 (A), to reject it. Reported-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: more verbose debugging for BPF filter generationPablo Neira Ayuso2012-07-251-14/+86
| | | | | | | | | | | | This patch adds more verbose output for the automatic BPF filter generation to sieve netlink messages that are receive via ctnetlink. This code is disabled by default, only useful for debugging so far. It shouldn't be hard to provide a function to explicitly print instead. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add nfct_set_attr_l and ATTR_HELPER_INFOPablo Neira Ayuso2012-06-266-72/+204
| | | | | | | | | | | | | | This adds the ATTR_HELPER_INFO that can be used to send binary data that will be attached to the conntrack. This is useful for the user-space connection tracking support. This patch also adds a new interface: nfct_set_attr_l(attr, type, value, length); that is used to set the variable length helper information. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>