summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--utils/Makefile.am6
-rw-r--r--utils/expect_create_userspace.c128
2 files changed, 133 insertions, 1 deletions
diff --git a/utils/Makefile.am b/utils/Makefile.am
index 26cbdc4..ec4bb85 100644
--- a/utils/Makefile.am
+++ b/utils/Makefile.am
@@ -1,7 +1,7 @@
include $(top_srcdir)/Make_global.am
check_PROGRAMS = expect_dump expect_create expect_get expect_delete \
- expect_flush expect_events \
+ expect_flush expect_events expect_create_userspace \
conntrack_create conntrack_dump conntrack_update \
conntrack_delete conntrack_flush conntrack_create_nat \
conntrack_get conntrack_events \
@@ -60,6 +60,10 @@ expect_create_SOURCES = expect_create.c
expect_create_LDADD = ../src/libnetfilter_conntrack.la
expect_create_LDFLAGS = -dynamic -ldl
+expect_create_userspace_SOURCES = expect_create_userspace.c
+expect_create_userspace_LDADD = ../src/libnetfilter_conntrack.la
+expect_create_userspace_LDFLAGS = -dynamic -ldl
+
expect_get_SOURCES = expect_get.c
expect_get_LDADD = ../src/libnetfilter_conntrack.la
expect_get_LDFLAGS = -dynamic -ldl
diff --git a/utils/expect_create_userspace.c b/utils/expect_create_userspace.c
new file mode 100644
index 0000000..67e7b2a
--- /dev/null
+++ b/utils/expect_create_userspace.c
@@ -0,0 +1,128 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <errno.h>
+
+#include <libnetfilter_conntrack/libnetfilter_conntrack.h>
+#include <libnetfilter_conntrack/libnetfilter_conntrack_tcp.h>
+
+/*
+ * This example shows how to setup a user-space expectation. This requires
+ * a Linux kernel >= 2.6.37.
+ */
+
+int main()
+{
+ int ret;
+ struct nfct_handle *h;
+ struct nf_conntrack *master, *expected, *mask;
+ struct nf_expect *exp;
+
+ /*
+ * Step 1: Setup master conntrack
+ */
+
+ master = nfct_new();
+ if (!master) {
+ perror("nfct_new");
+ exit(EXIT_FAILURE);
+ }
+
+ nfct_set_attr_u8(master, ATTR_L3PROTO, AF_INET);
+ nfct_set_attr_u32(master, ATTR_IPV4_SRC, inet_addr("1.1.1.1"));
+ nfct_set_attr_u32(master, ATTR_IPV4_DST, inet_addr("2.2.2.2"));
+
+ nfct_set_attr_u8(master, ATTR_L4PROTO, IPPROTO_TCP);
+ nfct_set_attr_u16(master, ATTR_PORT_SRC, htons(1025));
+ nfct_set_attr_u16(master, ATTR_PORT_DST, htons(21));
+
+ nfct_setobjopt(master, NFCT_SOPT_SETUP_REPLY);
+
+ nfct_set_attr_u8(master, ATTR_TCP_STATE, TCP_CONNTRACK_ESTABLISHED);
+ nfct_set_attr_u32(master, ATTR_TIMEOUT, 200);
+
+ h = nfct_open(CONNTRACK, 0);
+ if (!h) {
+ perror("nfct_open");
+ return -1;
+ }
+
+ /*
+ * In a real scenario in which you want to implement an helper in
+ * user-space with NFQUEUE, the master conntrack does not need to
+ * be created, since it should already exist.
+ */
+ ret = nfct_query(h, NFCT_Q_CREATE, master);
+
+ printf("TEST: add master conntrack ");
+ if (ret == -1)
+ printf("(%d)(%s)\n", ret, strerror(errno));
+ else
+ printf("(OK)\n");
+
+ nfct_close(h);
+
+ expected = nfct_new();
+ if (!expected) {
+ perror("nfct_new");
+ exit(EXIT_FAILURE);
+ }
+
+ nfct_set_attr_u8(expected, ATTR_L3PROTO, AF_INET);
+ nfct_set_attr_u32(expected, ATTR_IPV4_SRC, inet_addr("1.1.1.1"));
+ nfct_set_attr_u32(expected, ATTR_IPV4_DST, inet_addr("2.2.2.2"));
+
+ nfct_set_attr_u8(expected, ATTR_L4PROTO, IPPROTO_TCP);
+ nfct_set_attr_u16(expected, ATTR_PORT_SRC, 0);
+ nfct_set_attr_u16(expected, ATTR_PORT_DST, htons(10241));
+
+ mask = nfct_new();
+ if (!mask) {
+ perror("nfct_new");
+ exit(EXIT_FAILURE);
+ }
+
+ nfct_set_attr_u8(mask, ATTR_L3PROTO, AF_INET);
+ nfct_set_attr_u32(mask, ATTR_IPV4_SRC, 0xffffffff);
+ nfct_set_attr_u32(mask, ATTR_IPV4_DST, 0xffffffff);
+
+ nfct_set_attr_u8(mask, ATTR_L4PROTO, IPPROTO_TCP);
+ nfct_set_attr_u16(mask, ATTR_PORT_SRC, 0x0000);
+ nfct_set_attr_u16(mask, ATTR_PORT_DST, 0xffff);
+
+ /*
+ * Step 2: Setup expectation
+ */
+
+ exp = nfexp_new();
+ if (!exp) {
+ perror("nfexp_new");
+ exit(EXIT_FAILURE);
+ }
+
+ nfexp_set_attr(exp, ATTR_EXP_MASTER, master);
+ nfexp_set_attr(exp, ATTR_EXP_EXPECTED, expected);
+ nfexp_set_attr(exp, ATTR_EXP_MASK, mask);
+ nfexp_set_attr_u32(exp, ATTR_EXP_TIMEOUT, 200);
+
+ nfct_destroy(master);
+ nfct_destroy(expected);
+ nfct_destroy(mask);
+
+ h = nfct_open(EXPECT, 0);
+ if (!h) {
+ perror("nfct_open");
+ return -1;
+ }
+
+ ret = nfexp_query(h, NFCT_Q_CREATE, exp);
+
+ printf("TEST: create expectation ");
+ if (ret == -1)
+ printf("(%d)(%s)\n", ret, strerror(errno));
+ else
+ printf("(OK)\n");
+
+ nfct_close(h);
+
+ ret == -1 ? exit(EXIT_FAILURE) : exit(EXIT_SUCCESS);
+}