summaryrefslogtreecommitdiffstats
path: root/src/conntrack.c
Commit message (Collapse)AuthorAgeFilesLines
* conntrack: generalize command parsingMikhail Sennikovsky2022-07-081-13/+10
| | | | | | | | | | | | | Currently the -U command has a special case handling in the do_parse because it does not have EXP_ counterpart. Generalizing it would simplify adding support for new commands w/o EXP_ counterpart. As a preparation step for adding the new "-A" command support, make the -U command be handled the same way as the rest. Signed-off-by: Mikhail Sennikovsky <mikhail.sennikovskii@ionos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix -o save dump for unknown protocolsMikhail Sennikovsky2022-06-271-0/+9
| | | | | | | | | | | | | | Make sure the protocol (-p) option is included in the -o save ct entry dumps for L4 protocols unknown to the conntrack tool. Do not use getprotobynumber for unknown protocols to ensure "-o save" data incompatibility between hosts having different /etc/protocols contents. Include testcases covering the issue. Signed-off-by: Mikhail Sennikovsky <mikhail.sennikovskii@ionos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix protocol number parsingMikhail Sennikovsky2022-06-271-2/+17
| | | | | | | | | | | | Before this commit it was possible to successfully create a ct entry passing -p 256 and -p some_nonsense. In both cases an entry with the protocol=0 would be created. Do not allow invalid protocol values to -p option. Include testcases covering the issue. Signed-off-by: Mikhail Sennikovsky <mikhail.sennikovskii@ionos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: update CT_GET to use libmnlPablo Neira Ayuso2022-06-201-48/+3
| | | | | | | | Use nfct_mnl_request() to build and send the netlink command. Remove dump_cb() since this is a copy of the new libmnl's mnl_nfct_dump_cb() callback function. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: pass command object to nfct_mnl_request()Pablo Neira Ayuso2022-06-201-11/+14
| | | | | | | This patch comes in preparation for updating the CT_GET command to use libmnl. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: use same modifier socket for bulk opsMikhail Sennikovsky2022-06-201-6/+21
| | | | | | | | | | For bulk ct entry loads (with -R option) reusing the same mnl modifier socket for all entries results in reduction of entries creation time, which becomes especially signifficant when loading tens of thouthand of entries. Signed-off-by: Mikhail Sennikovsky <mikhail.sennikovskii@ionos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: unbreak event modeFlorian Westphal2022-05-161-1/+1
| | | | | | | | read() occurs from the wrong socket so 'conntrack -E' hangs without reporting any events. Fixes: 5ec684be0854 ("conntrack: consolidate socket open call") Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: remove -o userspaceFlorian Westphal2022-05-161-4/+3
| | | | | | | | | | This flag makes life a lot harder because lack of the flag hides very useful information. Remove it and always tag events triggered by userspace flush. Option is still parsed for backwards compatibility sake. Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: consolidate socket open callPablo Neira Ayuso2022-05-021-48/+17
| | | | | | | Create netlink socket once and reuse it, rather than open + close it over and over again. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* connntrack: Fix for memleak when parsing -j argPhil Sutter2022-03-281-0/+2
| | | | | | | Have to free the strings allocated by split_address_and_port(). Fixes: 29b390a212214 ("conntrack: Support IPv6 NAT") Signed-off-by: Phil Sutter <phil@nwl.cc>
* conntrack: use libmnl for flushing conntrack tableMikhail Sennikovsky2022-03-081-5/+8
| | | | | | | | Use libmnl and libnetfilter_conntrack mnl helpers to flush the conntrack table entries. Signed-off-by: Mikhail Sennikovsky <mikhail.sennikovskii@ionos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: use libmnl for ct entries deletionMikhail Sennikovsky2022-03-081-19/+28
| | | | | | | | Use libmnl and libnetfilter_conntrack mnl helpers to delete the conntrack table entries. Signed-off-by: Mikhail Sennikovsky <mikhail.sennikovskii@ionos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: use libmnl for updating conntrack tableMikhail Sennikovsky2022-03-081-43/+61
| | | | | | | | Use libmnl and libnetfilter_conntrack mnl helpers to update the conntrack table entries. Signed-off-by: Mikhail Sennikovsky <mikhail.sennikovskii@ionos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add nfct_mnl_request()Pablo Neira Ayuso2022-03-081-28/+17
| | | | | | | Provide a helper function to build and send the netlink request, this allows to consolidate nfct_mnl_get() and nfct_mnl_create(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: rename nfct_mnl_recv() to __nfct_mnl_dump()Pablo Neira Ayuso2022-03-081-3/+3
| | | | | | | nfct_mnl_recv() is misleading, this helper function allows you to perform a netlink dump, rename it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: pass sock to nfct_mnl_*() functionsMikhail Sennikovsky2021-12-241-53/+62
| | | | | | | | In preparation for using multiple instances of mnl sockets required for conntrack entries update and delete support. Signed-off-by: Mikhail Sennikovsky <mikhail.sennikovskii@ionos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: use libmnl to create entryPablo Neira Ayuso2021-12-241-6/+26
| | | | | | | Use libmnl to create entries through the new nfct_mnl_create() helper function. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add netlink flags to nfct_mnl_nlmsghdr_put()Pablo Neira Ayuso2021-12-241-4/+4
| | | | | | | Moreover, remove NLM_F_DUMP for IPCTNL_MSG_CT_GET_STATS since ctnetlink ignores this flag, this is simple netlink get command, not a dump. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add nfct_mnl_talk() and nfct_mnl_recv() helper functionsPablo Neira Ayuso2021-12-241-20/+34
| | | | | | Add helper function to consolidate nfct_mnl_dump() and nfct_mnl_get(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: use libmnl for listing conntrack tablePablo Neira Ayuso2021-11-141-20/+16
| | | | | | | Use libmnl and libnetfilter_conntrack mnl helpers to dump the conntrack table entries. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: enhance mnl_nfct_dump_cb()Pablo Neira Ayuso2021-11-141-12/+39
| | | | | | Add missing features in dump_cb() to mnl_nfct_dump_cb(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: pass filter_dump object to nfct_mnl_dump()Pablo Neira Ayuso2021-11-141-5/+10
| | | | | | In preparation for kernel filtering support for nfct_mnl_dump(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add support for chaintoolong stat counterFlorian Westphal2021-09-081-3/+4
| | | | | | | | | | | | | | | | | While at it, also fix up commit 5ec55c2a0a264 ("conntrack: add support for CLASH_RESOLVED counter"). The intention was to also print unknown statistic counters provided the attributes are of type u32, but mnl_attr_type_valid() needs the correct max-attr number for this to work. With this fix in place, conntrack -S shows: cpu=3 found=0 inv[..] clash_resolve=0 unknown1=8200 on a modified kernel. Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: add shorthand mnemonic for UNREPLIEDFlorian Westphal2021-08-051-0/+12
| | | | | | | | | conntrack tool prints [UNREPLIED] if a conntrack entry lacks the SEEN_REPLY bit. Accept this as '-u' argument too. If requested, mask is set to SEEN_REPLY and value remains 0 (bit not set). Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: enable kernel-based status filtering with -L -u STATUSFlorian Westphal2021-08-051-4/+55
| | | | | | | | | This change is backwards compatible: Old kernels do not recognize CTA_STATUS_MASK attribute and will ignore it (no filtering in kernel). Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: accept commands from fileMikhail Sennikovsky2021-05-031-6/+219
| | | | | | | | | | | | | | | | | | | | | | | | | | This commit implements the --load-file option which allows processing conntrack commands stored in file. Most often this would be used as a counter-part for the -o save option, which outputs conntrack entries in the format of the conntrack tool options. This could be useful when one needs to add/update/delete a large set of ct entries with a single conntrack tool invocation. This patch introduces a ct_cmd_list, which represents a list of ct_cmd elements. Expected syntax is "conntrack --load-file file". If "-" is given as a file name, stdin is used. No other commands or options are allowed to be specified in conjunction with the --load-file command. It is however possible to specify multiple --load-file file pairs. Example: Copy all entries from ct zone 11 to ct zone 12: conntrack -L -w 11 -o save | sed "s/-w 11/-w 12/g" | \ conntrack --load-file - Joint work with Pablo. Signed-off-by: Mikhail Sennikovsky <mikhail.sennikovskii@ionos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: release options after parsingPablo Neira Ayuso2021-05-031-1/+2
| | | | | | | | | | | | | | | Fix memleak in parser: ==8445== 3,808 bytes in 2 blocks are definitely lost in loss record 6 of 6 ==8445== at 0x483577F: malloc (vg_replace_malloc.c:299) ==8445== by 0x112636: merge_options (conntrack.c:1056) ==8445== by 0x112636: do_parse (conntrack.c:2903) ==8445== by 0x11343E: ct_file_parse_line (conntrack.c:3672) ==8445== by 0x11343E: ct_parse_file (conntrack.c:3693) ==8445== by 0x10D819: main (conntrack.c:3750) Fixes: 8f76d6360dbf ("conntrack: add struct ct_cmd") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add function to print command statsPablo Neira Ayuso2021-03-151-8/+17
| | | | | | Wrap code to display command stats in a function. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: move options flag to ct_cmd objectPablo Neira Ayuso2021-03-151-48/+59
| | | | | | Prepare for the batch support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: pass cmd to filter nat, mark and network functionsPablo Neira Ayuso2021-03-151-10/+11
| | | | | | | Pass the command object to the nat, mark and IP address userspace filters. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: pass cmd to nfct_filter()Pablo Neira Ayuso2021-03-151-10/+9
| | | | | | Pass the command object to the userspace filter routine. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: pass ct_cmd to nfct_filter_init()Pablo Neira Ayuso2021-03-151-6/+8
| | | | | | Pass command object to initialize the userspace filter. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: pass command object to callbacksPablo Neira Ayuso2021-03-151-23/+27
| | | | | | | | | Pass the command object to prepare for batch support. Move ct_cmd structure definition right at the top of file otherwise compilation breaks. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add do_command_ct()Pablo Neira Ayuso2021-01-141-20/+24
| | | | | | Wrap the code to run the command around the do_command_ct() function. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add struct ct_tmplPablo Neira Ayuso2021-01-141-110/+121
| | | | | | | | | | | | | | Remove the global template object, add it to struct ct_cmd. This patch prepares for the batch support. The global cur_tmpl pointer is used to access the template from the callbacks and the exit_error() path. Note that it should be possible to remove this global cur_tmpl pointer by passing the new command object as parameter to the callbacks and exit_error(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add struct ct_cmdPablo Neira Ayuso2021-01-141-49/+76
| | | | | | | This new object stores the result of the command parser, this prepares for batch support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: pretty-print the portidFlorian Westphal2020-12-171-7/+172
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | DESTROY events already include the portid. Add some /proc glue to lookup the portid. Problem is that there is no direct mapping to a name. Lookup steps are: 1. Obtain the portid inode from /proc/net/netlink. If we can't even find that, no luck. 2. assume portid == pid and search /proc/portid/fd/ for a socket with matching inode. This is modeled on iproute2 ss tool. If /proc/portid/fd/ comes up empty, entire process space (/proc/*/fd) is searched for a matching inode. As this is quite some work, cache the last portid result (including 'not found', so that 'conntrack -F' generating 10000k events will do this lookup only once. The lookup won't work in case the deleting/flushing program has already exited; in that case [USERSPACE] tag and portid are still included. Example: $ conntrack -E -o userspace [DESTROY] tcp 6 src=192... dst=192... sport=4404 dport=22 ... [USERSPACE] portid=5146 progname=conntrack Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: implement save output formatMikhail Sennikovsky2020-11-021-4/+279
| | | | | | | | | | | | | | | This commit allows dumping conntrack entries in the format used by the conntrack parameters, aka "save" output format. This is useful for saving ct entry data to allow applying it later on. To enable the "save" output the "-o save" parameter needs to be passed to the conntrack tool invocation. [ pablo@netfilter.org: several updates to the original patch ] Signed-off-by: Mikhail Sennikovsky <mikhail.sennikovskii@cloud.ionos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: allow to flush per familyPablo Neira Ayuso2020-10-291-2/+2
| | | | | | | | This allows users to flush IPv4 entries only through: conntrack -F -f ipv4 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: allow to filter event by familyPablo Neira Ayuso2020-10-281-2/+5
| | | | | | | | This patch allows you to filter event through -f, e.g. conntrack -E -f ipv4 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: default to unspec family for dualstack setupsPablo Neira Ayuso2020-10-271-3/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 2bcbae4c14b2 ("conntrack: -f family filter does not work") restored the fallback to IPv4 if -f is not specified, which was the original behaviour. This patch modifies the default to use the unspec family if -f is not specified for the following ct commands: - list - update - delete - get (these two commands below do not support for -f though, but in case this is extended in the future to support it): - flush - event The existing code that parses IPv4 and IPv6 addresses already infers the family, which simplifies the introduction of this update. The expect commands are not updated, they still require many mandatory options for filtering. This patch includes a few test updates too. Based on patch from Mikhail Sennikovsky. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add support for CLASH_RESOLVED counterFlorian Westphal2020-08-251-3/+14
| | | | | | | | | | While at it, also allow to display up to 4 counters that are sent by kernel but that we do not know. This is useful to list counters that a new kernel supports with and older release of conntrack-tools. Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: add support for the IPS_HW_OFFLOAD flagPablo Neira Ayuso2020-04-281-2/+2
| | | | | | | This patch adds support for the IPS_HW_OFFLOAD flag which specifies that this conntrack entry has been offloaded into the hardware. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: Fix CIDR to mask conversion on Big EndianPhil Sutter2019-09-041-1/+1
| | | | | | | | | | Code assumed host architecture to be Little Endian. Instead produce a proper mask by pushing the set bits into most significant position and apply htonl() on the result. Fixes: 3f6a2e90936bb ("conntrack: add support for CIDR notation") Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: support for IPS_OFFLOADPablo Neira Ayuso2019-08-091-3/+4
| | | | | | | | # conntrack -L -u OFFLOAD tcp 6 431984 ESTABLISHED src=192.168.10.2 dst=10.0.1.2 sport=32824 dport=5201 src=10.0.1.2 dst=10.0.1.1 sport=5201 dport=32824 [OFFLOAD] mark=0 secctx=null use=2 tcp 6 431984 ESTABLISHED src=192.168.10.2 dst=10.0.1.2 sport=32826 dport=5201 src=10.0.1.2 dst=10.0.1.1 sport=5201 dport=32826 [OFFLOAD] mark=0 secctx=null use=2 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: Allow protocol number zeroBrian Haley2019-03-201-1/+1
| | | | | | | | | | | /etc/protocols defines protocol zero as 'ip' for IPv4, and 'hopopt' for IPv6, which can be used with conntrack as '-p ip' or '-p hopopt'. However it's equivalent, '-p 0' is considered unsupported. Change the range check in findproto() to allow zero as well. Signed-off-by: Brian Haley <bhaley@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add -o userspace option to tag user-triggered eventsPablo Neira Ayuso2019-02-201-5/+14
| | | | | | | | | | | | | | The following command: # conntrack -E -o userspace & # conntrack -F [DESTROY] tcp 6 src=122.127.186.172 dst=192.168.10.195 sport=443 dport=48232 packets=56 bytes=5313 src=192.168.10.195 dst=122.127.186.172 sport=48232 dport=443 packets=49 bytes=5174 [ASSURED] [USERSPACE] prints the [USERSPACE] tag at the end of the event, this tells users if this event has been triggered by process, eg. via conntrack command invocation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: use libmnl for conntrack eventsPablo Neira Ayuso2019-02-201-37/+83
| | | | | | Use libmnl instead libnfnetlink infrastructure. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: extend nfct_mnl_socket_open() to use it to handle eventsPablo Neira Ayuso2019-02-201-8/+8
| | | | | | Add parameter to nfct_mnl_socket_open() to subscribe to events. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: -f family filter does not workRonald Wahl2018-05-091-6/+6
| | | | | | | | | | "conntrack -L -f ipv4" and "conntrack -L -f ipv6" each prints both protocols. This is because the family filtering is now enabled only if filter_mark_kernel_set is true. Fixes: 8b8377163697 ("conntrack: send mark filter to kernel iff set") Signed-off-by: Ronald Wahl <ronald.wahl@raritan.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>