summaryrefslogtreecommitdiffstats
path: root/src/conntrack.c
Commit message (Collapse)AuthorAgeFilesLines
* conntrack: accept commands from fileMikhail Sennikovsky2021-05-031-6/+219
| | | | | | | | | | | | | | | | | | | | | | | | | | This commit implements the --load-file option which allows processing conntrack commands stored in file. Most often this would be used as a counter-part for the -o save option, which outputs conntrack entries in the format of the conntrack tool options. This could be useful when one needs to add/update/delete a large set of ct entries with a single conntrack tool invocation. This patch introduces a ct_cmd_list, which represents a list of ct_cmd elements. Expected syntax is "conntrack --load-file file". If "-" is given as a file name, stdin is used. No other commands or options are allowed to be specified in conjunction with the --load-file command. It is however possible to specify multiple --load-file file pairs. Example: Copy all entries from ct zone 11 to ct zone 12: conntrack -L -w 11 -o save | sed "s/-w 11/-w 12/g" | \ conntrack --load-file - Joint work with Pablo. Signed-off-by: Mikhail Sennikovsky <mikhail.sennikovskii@ionos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: release options after parsingPablo Neira Ayuso2021-05-031-1/+2
| | | | | | | | | | | | | | | Fix memleak in parser: ==8445== 3,808 bytes in 2 blocks are definitely lost in loss record 6 of 6 ==8445== at 0x483577F: malloc (vg_replace_malloc.c:299) ==8445== by 0x112636: merge_options (conntrack.c:1056) ==8445== by 0x112636: do_parse (conntrack.c:2903) ==8445== by 0x11343E: ct_file_parse_line (conntrack.c:3672) ==8445== by 0x11343E: ct_parse_file (conntrack.c:3693) ==8445== by 0x10D819: main (conntrack.c:3750) Fixes: 8f76d6360dbf ("conntrack: add struct ct_cmd") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add function to print command statsPablo Neira Ayuso2021-03-151-8/+17
| | | | | | Wrap code to display command stats in a function. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: move options flag to ct_cmd objectPablo Neira Ayuso2021-03-151-48/+59
| | | | | | Prepare for the batch support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: pass cmd to filter nat, mark and network functionsPablo Neira Ayuso2021-03-151-10/+11
| | | | | | | Pass the command object to the nat, mark and IP address userspace filters. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: pass cmd to nfct_filter()Pablo Neira Ayuso2021-03-151-10/+9
| | | | | | Pass the command object to the userspace filter routine. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: pass ct_cmd to nfct_filter_init()Pablo Neira Ayuso2021-03-151-6/+8
| | | | | | Pass command object to initialize the userspace filter. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: pass command object to callbacksPablo Neira Ayuso2021-03-151-23/+27
| | | | | | | | | Pass the command object to prepare for batch support. Move ct_cmd structure definition right at the top of file otherwise compilation breaks. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add do_command_ct()Pablo Neira Ayuso2021-01-141-20/+24
| | | | | | Wrap the code to run the command around the do_command_ct() function. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add struct ct_tmplPablo Neira Ayuso2021-01-141-110/+121
| | | | | | | | | | | | | | Remove the global template object, add it to struct ct_cmd. This patch prepares for the batch support. The global cur_tmpl pointer is used to access the template from the callbacks and the exit_error() path. Note that it should be possible to remove this global cur_tmpl pointer by passing the new command object as parameter to the callbacks and exit_error(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add struct ct_cmdPablo Neira Ayuso2021-01-141-49/+76
| | | | | | | This new object stores the result of the command parser, this prepares for batch support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: pretty-print the portidFlorian Westphal2020-12-171-7/+172
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | DESTROY events already include the portid. Add some /proc glue to lookup the portid. Problem is that there is no direct mapping to a name. Lookup steps are: 1. Obtain the portid inode from /proc/net/netlink. If we can't even find that, no luck. 2. assume portid == pid and search /proc/portid/fd/ for a socket with matching inode. This is modeled on iproute2 ss tool. If /proc/portid/fd/ comes up empty, entire process space (/proc/*/fd) is searched for a matching inode. As this is quite some work, cache the last portid result (including 'not found', so that 'conntrack -F' generating 10000k events will do this lookup only once. The lookup won't work in case the deleting/flushing program has already exited; in that case [USERSPACE] tag and portid are still included. Example: $ conntrack -E -o userspace [DESTROY] tcp 6 src=192... dst=192... sport=4404 dport=22 ... [USERSPACE] portid=5146 progname=conntrack Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: implement save output formatMikhail Sennikovsky2020-11-021-4/+279
| | | | | | | | | | | | | | | This commit allows dumping conntrack entries in the format used by the conntrack parameters, aka "save" output format. This is useful for saving ct entry data to allow applying it later on. To enable the "save" output the "-o save" parameter needs to be passed to the conntrack tool invocation. [ pablo@netfilter.org: several updates to the original patch ] Signed-off-by: Mikhail Sennikovsky <mikhail.sennikovskii@cloud.ionos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: allow to flush per familyPablo Neira Ayuso2020-10-291-2/+2
| | | | | | | | This allows users to flush IPv4 entries only through: conntrack -F -f ipv4 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: allow to filter event by familyPablo Neira Ayuso2020-10-281-2/+5
| | | | | | | | This patch allows you to filter event through -f, e.g. conntrack -E -f ipv4 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: default to unspec family for dualstack setupsPablo Neira Ayuso2020-10-271-3/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 2bcbae4c14b2 ("conntrack: -f family filter does not work") restored the fallback to IPv4 if -f is not specified, which was the original behaviour. This patch modifies the default to use the unspec family if -f is not specified for the following ct commands: - list - update - delete - get (these two commands below do not support for -f though, but in case this is extended in the future to support it): - flush - event The existing code that parses IPv4 and IPv6 addresses already infers the family, which simplifies the introduction of this update. The expect commands are not updated, they still require many mandatory options for filtering. This patch includes a few test updates too. Based on patch from Mikhail Sennikovsky. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add support for CLASH_RESOLVED counterFlorian Westphal2020-08-251-3/+14
| | | | | | | | | | While at it, also allow to display up to 4 counters that are sent by kernel but that we do not know. This is useful to list counters that a new kernel supports with and older release of conntrack-tools. Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: add support for the IPS_HW_OFFLOAD flagPablo Neira Ayuso2020-04-281-2/+2
| | | | | | | This patch adds support for the IPS_HW_OFFLOAD flag which specifies that this conntrack entry has been offloaded into the hardware. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: Fix CIDR to mask conversion on Big EndianPhil Sutter2019-09-041-1/+1
| | | | | | | | | | Code assumed host architecture to be Little Endian. Instead produce a proper mask by pushing the set bits into most significant position and apply htonl() on the result. Fixes: 3f6a2e90936bb ("conntrack: add support for CIDR notation") Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: support for IPS_OFFLOADPablo Neira Ayuso2019-08-091-3/+4
| | | | | | | | # conntrack -L -u OFFLOAD tcp 6 431984 ESTABLISHED src=192.168.10.2 dst=10.0.1.2 sport=32824 dport=5201 src=10.0.1.2 dst=10.0.1.1 sport=5201 dport=32824 [OFFLOAD] mark=0 secctx=null use=2 tcp 6 431984 ESTABLISHED src=192.168.10.2 dst=10.0.1.2 sport=32826 dport=5201 src=10.0.1.2 dst=10.0.1.1 sport=5201 dport=32826 [OFFLOAD] mark=0 secctx=null use=2 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: Allow protocol number zeroBrian Haley2019-03-201-1/+1
| | | | | | | | | | | /etc/protocols defines protocol zero as 'ip' for IPv4, and 'hopopt' for IPv6, which can be used with conntrack as '-p ip' or '-p hopopt'. However it's equivalent, '-p 0' is considered unsupported. Change the range check in findproto() to allow zero as well. Signed-off-by: Brian Haley <bhaley@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add -o userspace option to tag user-triggered eventsPablo Neira Ayuso2019-02-201-5/+14
| | | | | | | | | | | | | | The following command: # conntrack -E -o userspace & # conntrack -F [DESTROY] tcp 6 src=122.127.186.172 dst=192.168.10.195 sport=443 dport=48232 packets=56 bytes=5313 src=192.168.10.195 dst=122.127.186.172 sport=48232 dport=443 packets=49 bytes=5174 [ASSURED] [USERSPACE] prints the [USERSPACE] tag at the end of the event, this tells users if this event has been triggered by process, eg. via conntrack command invocation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: use libmnl for conntrack eventsPablo Neira Ayuso2019-02-201-37/+83
| | | | | | Use libmnl instead libnfnetlink infrastructure. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: extend nfct_mnl_socket_open() to use it to handle eventsPablo Neira Ayuso2019-02-201-8/+8
| | | | | | Add parameter to nfct_mnl_socket_open() to subscribe to events. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: -f family filter does not workRonald Wahl2018-05-091-6/+6
| | | | | | | | | | "conntrack -L -f ipv4" and "conntrack -L -f ipv6" each prints both protocols. This is because the family filtering is now enabled only if filter_mark_kernel_set is true. Fixes: 8b8377163697 ("conntrack: send mark filter to kernel iff set") Signed-off-by: Ronald Wahl <ronald.wahl@raritan.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: Show multiple CPUs stats from procChieh-Min Wang2017-08-241-16/+18
| | | | | | | | | When read cpu conntrack stats from /proc/net/stat/nf_conntrack, it only shows stats from cpu0. This patch list all cpus' conntrack stats like what `nfexp_stats_cb` did. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: remove use of HAVE_INET_PTON_IPV6Nicolas Dichtel2017-06-061-2/+0
| | | | | | | | | | | | | | | | | The goal of this patch is to fix the ipv6 support when conntrackd is cross-compiled. The AC_RUN_IFELSE macro must be avoided as much as possible. See section 6.6 of the gnu autoconf: "If you really need to test for a runtime behavior while configuring, you can write a test program to determine the result, and compile and run it using AC_RUN_IFELSE. Avoid running test programs if possible, because this prevents people from configuring your package for cross-compiling." Let's remove this check and test the returned error to handle the case where ipv6 is not supported (inet_pton() returns -1 when the family is not supported). Reported-by: Zhenlin Zhang <zhenlin.zhang@6wind.com> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: Support IPv6 NATNeil Wilson2017-03-171-67/+146
| | | | | | | | | | Refactor and improve nat support to allow conntrack to manage IPv6 NAT entries. Refactor and improve conntrack nat tests to include IPv6 NAT. Signed-off-by: Neil Wilson <neil@aldur.co.uk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: send mark filter to kernel iff setPablo Neira Ayuso2016-12-231-10/+18
| | | | | | | | | Do not set a mark filter to ctnetlink if the user doesn't explicitly specify this. Fixes: aa925010951e ("conntrack: allow to filter by mark from kernel-space") Reported-by: Joseph Conley <joseph.j.conley@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: show --src and --dst options in usage output.Mart Frauenlob2016-04-081-2/+2
| | | | Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at>
* conntrack: Add missing tables dying and unconfirmed to usage output.Mart Frauenlob2016-04-071-1/+1
| | | | | Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add support for CIDR notationAsbjørn Sloth Tønnesen2016-02-161-5/+81
| | | | | | | | | | | | | | Add support for using CIDR notation in --{orig,tuple}-{src,dst} arguments, instead of free-form formatting netmask in --mask-{src,dst}. Example: conntrack -L -s 2001:db8::/56 Instead of: conntrack -L -s 2001:db8:: --mask-src ffff:ffff:ffff:ff00:: Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: extend parse_addr() with CIDR supportAsbjørn Sloth Tønnesen2016-02-161-7/+28
| | | | Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk>
* conntrack: split up nfct_set_addr_from_opt()Asbjørn Sloth Tønnesen2016-02-161-13/+20
| | | | | | | | | Prepare for CIDR support, by splitting nfct_set_addr_from_opt() into nfct_parse_addr_from_opt() for parsing and nfct_set_addr_opt() for storing. Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add support for netmask filteringAsbjørn Sloth Tønnesen2016-02-081-13/+145
| | | | | | | | This patch extends --mask-src and --mask-dst to also work with the conntrack table, with commands -L, -D, -E and -U. Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: cleanup: use switch statements for family checksAsbjørn Sloth Tønnesen2016-02-011-8/+16
| | | | | Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: consolidate filteringAsbjørn Sloth Tønnesen2016-02-011-37/+20
| | | | | Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: support delete by labelAsbjørn Sloth Tønnesen2016-02-011-0/+3
| | | | | | | | | | | This option was already silently allowed by 991fc4ae, but didn't have any effect. This patch adds the check and documents it. Cc: Clemence Faure <clemence.faure@sophos.com> Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix expectation entry creationAsbjørn Sloth Tønnesen2016-01-191-2/+4
| | | | | | | | | | | | | Store tuple-src and tuple-dst in exptuple, as used by the EXP_CREATE case. Verified with doc/cli/test.sh Also reorder the cases, so the netmask case is last. Reported-by: Szilárd Pfeiffer <pfeiffer.szilard@balabit.hu> Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "conntrack: fix expectation entry creation"Asbjørn Sloth Tønnesen2016-01-191-2/+0
| | | | | | | | | | {} is mask-src and mask-dst, [] is tuple-src and tuple-dst mask-* should be stored in mask, tuple-* should be stored in exptuple. This reverts commit 3309fdb4413cb32f9b95e05064dc9dbb56550939 since it mixed up {} and []. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add zone direction supportDaniel Borkmann2015-09-291-24/+43
| | | | | | | | | | | | | | | | This patch adds support for zone directions. Since all options have the orig/reply as a prefix, I named it --orig-zone and --reply-zone to stay consistent with the rest of the cmdline options. As for the option chars, there was no unallocated reasonable combination, thus only long options are officially exposed in the help, similarly as in other cases. Test suite results, after patch: OK: 79 BAD: 0 Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: made the protocol option value case insensitiveSzilárd Pfeiffer2015-07-031-1/+1
| | | | | | | | | Extensions register protocols by lowercase protocol name, but value of proto command line option may be uppercase. Extension related options cannot be used when protocol name comparision fails. Signed-off-by: Szilárd Pfeiffer <pfeiffer.szilard@balabit.hu> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: fix expectation entry creationSzilárd Pfeiffer2015-06-261-0/+2
| | | | | Signed-off-by: Szilárd Pfeiffer <pfeiffer.szilard@balabit.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: refactor handling of address optionsSzilárd Pfeiffer2015-06-261-37/+32
| | | | | Signed-off-by: Szilárd Pfeiffer <pfeiffer.szilard@balabit.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix setting labels in updatesJarno Rajahalme2015-02-131-5/+19
| | | | | | | | | | | | | | | | | | When updating labels we always have to send the same sized bitmask as we received, as the bits we do omit will otherwise cleared as "padding". Mask has to have the same size as the labels, otherwise it will not be encoded by libnetfilter_conntrack, as different sizes are not accepted by the kernel either. Finally, kernel only retains old bit values that we send as zeroes in BOTH the label and the mask, due to XOR used in bit manipulation. This patch fixes all these issues and allows updates to set new labels without accidentally clearing old ones. Signed-off-by: Jarno Rajahalme <jrajahalme@nicira.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: do not exit when update returns an errorFlorian Westphal2013-09-151-5/+3
| | | | | | | | | | If we fail to update an entry, just try to continue with the next one instead of exiting. Can happen f.e. when using "conntrack -U --add-label bla", but the conntrack entry in the kernel does not have the label extension set. Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: support add/delete of conntrack labelsClemence Faure2013-09-151-24/+130
| | | | | | | | new options "--label-add" and "--label-delete" to alter connlabels assigned to a connection. Signed-off-by: Clemence Faure <clemence.faure@sophos.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: support multiple -l optionsFlorian Westphal2013-09-151-1/+28
| | | | | | | | Using -l foo -l bar caused the "foo" label to be lost. Merge multiple -l options so "-l foo,bar" and "-l foo -l bar" have same effect. Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: minor cleanupFlorian Westphal2013-09-041-22/+19
| | | | | | | | | Rename get_table to generic "optional argument handling" helper, so it can be re-used in upcoming patch. While at it, avoid copy&paste of "labelmap" handling. Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: fix dump of IPv6 entries in the dying and unconfirmed listPablo Neira Ayuso2013-08-071-11/+12
| | | | | | Use selected the family, instead of inconditionally request for IPv4. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>